1

I am going to performing an internal pentest. Is it possible to sniff active directory credentials using Wireshark or Ettercap when a user logs on and authenticates to using their domain credentials?

Improve this question

1 Answer 1

Reset to default
1

Provided a server is involved in the authentication process, yes, it is possible to sniff the login credentials.

Improve this answer
4
  • the server would be a windows domain controller does Microsoft encrypt the password before sending it to the domain controller
    – okhan
    May 12, 2017 at 13:25
  • Yes, the password will be encrypted with AES-128 encryption.
    – Joe
    May 12, 2017 at 13:33
  • thank you so much for your time in answering my question. Also would I be able to capture this password and maybe replay it like a pass the hash. It seams kind of pointless to encrypt the password if data can be sent in cypertext.
    – okhan
    May 15, 2017 at 17:53
  • Yes, I believe it is possible for a pass the hash attack to be done in this way.
    – Joe
    May 15, 2017 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .