I created a lab environment which has Windows 7 and Kali Linux in VMware.
In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an HTTP site and entered some login information to that site.
Wireshark was able to capture that login information.
How does Wireshark capture those packets? Windows 7 sent its packets to the router but Wireshark was able to capture them.
I didn't use arpspoof for MITM attack so I didn't trick Windows 7 into thinking the Kali machine was the gateway nor gateway as kali machine is windows 7. So my guess was Wireshark shouldn't capture those packets but it did capture them anyway.
Anybody can tell me why?