I need to prove the need we have to install SSL certificates in our webservers.

For that I've been requested to try obtaining sample credentials (in lab enviroment) during a http authentication process.

How can I do this?


Use a packet capture tool like Wireshark to search for the password string as it passes over the network. Basically, wireshark makes a copy of all the network packets it can see from the computer it is installed on. You then use various tools and filters to search those captured packets for data you're interested in.

Step by step instructions can be easily found online (here for example), but are a bit too involved to reproduce here.

  • Thank you very much @scuzzy-delta! I've just did it. Do you know how to do the same thing but acting as a Man-in-the-middle? capturing not only packets from my PC to that webserver but also from everywhere? – srbob Apr 4 '14 at 9:08
  • 1
    Yes, but you have to be positioned as a router close to the web server. That's beside the point though, beacuse now that you have proven the cleartext password transmission, you have also proven that every router between a user and your web server can capture those packets, not to mention any device on the users local network. In my opinion you are being asked to prove too much - it should already be obvious to your supervisors that cleartext transmission of credentials is very very bad. – scuzzy-delta Apr 4 '14 at 12:45

Assuming your server is a Linux box, run something like tcpdump -i any -s 1600 -w /tmp/dump port 80 on it during a user authentication, and then go digging through /tmp/dump to find the credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.