4

In my pentesting lab I'm using ettercap for do a mitm to a XP VM.

I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like pentest/pentestpasswd try to login and stop the sniffer.

In this moment, ettercap shows that user/password stolen. I'm trying to find that info in Wireshark too, but I can't. Even following the TCP stream, I can't.

Some advice?

Improve this question

1 Answer 1

Reset to default
3

you wont be able to see it plain text in wireshark. the packets are encrypted ettercap is acting as a relay, your pc connects to ettercap which decrypts the login info then encrypts it again to send it to the real gmail server

Improve this answer
2
  • Ah ok, I was thinking that ettercap sent them decrypted.
    – user15194
    Dec 24, 2012 at 21:24
  • 1
    If im not mistaken Max you are referring to the need to do a SSL strip.
    – Oscalation
    Dec 26, 2012 at 5:33

You must log in to answer this question.