To add to what @Rory says, you might want to refine what you mean by "without modification". Technically, every single byte your computer sends and receives will go through the router, so whoever has full control on the router can potentially get a copy of it. Without any form of encryption, he will see everything, including names of Web sites and plaintext passwords (which are called "plaintext" for that precise reason).
Even if the site uses HTTPS, the router admin will be able to deduce the name of the site, from three sources:
- All IP packets will be tagged with, as destination, the IP address of the server hosting that site.
- In the initial steps of the SSL handshake, prior to the activation of the encryption, the server will send its certificate, which contains the site name (and the client may also advertise it as part of the SNI extension).
- Before opening the connection, your computer will first need to obtain the IP address of the target server, and it will do so by sending a DNS request, which is unencrypted and contains the target site name.
However, a basic router will offer a user interface which does not, by default, allow such kind of inspection. So an unskilled neighbour may not know how to alter his router to install such spying (or, similarly, how to install and operate another computer, also linked to that router, and observing the traffic at the WiFi level -- something which may be easier to do, in fact, than catering with the router's configuration options). So it really depends on the extent of knowledge of your neighbour (including the knowledge of his snarky teenage nephew who "does computers", if applicable).
To protect your traffic, you must use an all-encompassing solution, namely a VPN of some sort. All your traffic (including DNS requests) has to go to some server somewhere, with encryption applied for this link. There are commercial VPN providers, who will offer this service... at a cost. If you have SSH access to some machine somewhere, you can also setup a SOCKS proxy which will handle all traffic from your Web browser (but not from, e.g., online game applications).