In my pentesting lab I'm using ettercap for do a mitm to a XP VM.

I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like pentest/pentestpasswd try to login and stop the sniffer.

In this moment, ettercap shows that user/password stolen. I'm trying to find that info in Wireshark too, but I can't. Even following the TCP stream, I can't.

Some advice?


you wont be able to see it plain text in wireshark. the packets are encrypted ettercap is acting as a relay, your pc connects to ettercap which decrypts the login info then encrypts it again to send it to the real gmail server

| improve this answer | |
  • Ah ok, I was thinking that ettercap sent them decrypted. – Ay0 Dec 24 '12 at 21:24
  • 1
    If im not mistaken Max you are referring to the need to do a SSL strip. – Oscalation Dec 26 '12 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.