Sniff Credentials on a Test Network

You've mapped the network, found open ports, and maybe even identified a vulnerable service. But the real prize for an attacker — and the real danger for a company — is a valid set of credentials. Usernames and passwords flow across the network every day, often in plaintext. In this lesson, you'll learn how to sniff credentials on a local test network using the industry-standard tool Wireshark, transforming your reconnaissance skills into a practical, ethical credential-capture technique. This step-by-step guide will teach you the core concepts, a hands-on walkthrough, and how to troubleshoot common issues — all in a safe, controlled lab environment.

The Problem This Lesson Solves

Imagine you're a penetration tester hired to assess a company's internal network. You've discovered that a legacy application sends login requests over HTTP, not HTTPS. An attacker on the same Wi-Fi network could capture those credentials and gain unauthorized access. How would you prove that risk to the client?

This lesson solves that problem by teaching you network sniffing — the art of capturing and analyzing data packets traversing a network. You'll learn how to intercept traffic and extract sensitive information like usernames and passwords. By mastering this skill in a controlled test environment, you can demonstrate real-world vulnerabilities without crossing legal or ethical boundaries. You'll also understand the defensive implications: if you can sniff credentials, so can a malicious actor, which is why encryption (HTTPS, VPNs) is non-negotiable in modern networks.

The pain point is clear: without this skill, you're blind to the most common and damaging attack vector — credential theft. Let's fix that.

Core Concept / Mental Model

Think of a network as a busy post office. Every message (packet) is a letter with a sender and recipient address (IP and MAC). Normally, a switch delivers letters only to the intended recipient, but any device can be set to "listen" to all mail that passes by — that's promiscuous mode.

Network sniffing is like standing in the post office and reading every postcard; if the content is in plaintext (unencrypted), you can read it. The two key players in this process are:

• Wireshark: A widely-used network protocol analyzer with a graphical interface. It's the de facto standard for packet capture and analysis.
• tcpdump: A command-line alternative, lighter-weight, often used in scripts or headless servers.

Both tools capture packets, but Wireshark excels at deep inspection and filtering, while tcpdump is great for quick captures. For credential sniffing, you'll primarily use Wireshark's Follow TCP Stream feature to reassemble the data exchange between client and server.

It's also crucial to understand the concept of protocols: credentials can be sent via several protocols — HTTP (plaintext), FTP (plaintext), Telnet (plaintext), SMTP (often plaintext), and others. The goal is to filter for these protocols and locate the packets that carry authentication data.

Legal and ethical boundaries are paramount. Always obtain explicit permission before sniffing any network you don't own. Never use these skills on production or public networks without authorization. This lesson uses a local test network, which you'll set up in the next section.

How It Works Step by Step

The process of sniffing credentials can be broken down into these logical steps:

1. Set up a controlled lab environment: You need a private network with at least two machines (or VMs) — one that will act as the "client" sending login requests, and another that will be the "server" hosting a vulnerable service (like an HTTP login form or an FTP server). The attacker machine (where you'll run Wireshark) can be any of these machines or a third, depending on the network topology.
2. Start packet capture: Launch Wireshark on the attacker machine, select the appropriate network interface (e.g., eth0, Wi-Fi), and start capturing packets.
3. Generate traffic: On the client, open a browser and log in to the HTTP application, or use an FTP client to connect to an FTP server with credentials. This generates packets containing the plaintext credentials.
4. Capture and filter: Wireshark will capture all packets on the network. To isolate the traffic, apply a display filter, such as http.request.method == "POST" to view HTTP login posts, or simply http or ftp.
5. Follow the TCP stream: Right-click on a relevant packet and select "Follow > TCP Stream" to see the entire conversation between client and server in a single window, including the username and password in plaintext.
6. Extract credentials: The stream window will show the credentials clearly. Document them as evidence for your penetration test report.

The key cause-and-effect relationship is: unencrypted traffic + promiscuous capture = exposed credentials. If the traffic were encrypted (HTTPS, SSH), you would need additional techniques (like MITM with SSL stripping) which are beyond this lesson's scope.

Hands-On Walkthrough

Let's put theory into practice. You'll need:

• A computer with Wireshark installed (available on Linux, Windows, macOS)
• A test server that serves an HTTP login form. You can use a simple Python HTTP server for this purpose.

Step 1: Create a test server. On your server machine, save the following Python script as http_server.py and run it. This script will listen on port 8000 and respond to a POST request with a simple message.

from http.server import HTTPServer, BaseHTTPRequestHandler
import urllib.parse

class CredentialHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_length = int(self.headers['Content-Length'])
        body = self.rfile.read(content_length).decode('utf-8')
        print(f"Received credentials: {body}")
        self.rfile.read(content_length)  # consume the body (fix)
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"Login successful")

if __name__ == '__main__':
    server = HTTPServer(('0.0.0.0', 8000), CredentialHandler)
    print("Server listening on port 8000")
    server.serve_forever()

Note: The self.rfile.read() after reading the body may not be necessary but ensures the request is fully consumed. If you encounter BrokenPipeError, simplified versions are fine.

Step 2: Start Wireshark capture. Open Wireshark, select your network interface (e.g., eth0 for Ethernet or wlan0 for Wi-Fi) and click the blue shark fin icon to start capturing packets.

Step 3: Send a login request. On the client machine, open a terminal (or browser) and send a POST request using curl:

curl -X POST -d "username=alice&password=secret123" http://<server-ip>:8000/login

Replace <server-ip> with the actual IP of your server. This simulates a login form submission.

Step 4: Find the packet in Wireshark. In Wireshark, apply the display filter http.request.method == "POST" to narrow down. You should see your POST request packet. Select it, right-click, and choose Follow > TCP Stream.

Step 5: Extract credentials. A new window will pop up showing the HTTP conversation. You'll see lines like:

POST /login HTTP/1.1
Host: 192.168.1.10:8000
Content-Type: application/x-www-form-urlencoded
...
username=alice&password=secret123

There they are — the credentials in plain sight! Record them for your report.

Expected output: The Wireshark TCP stream window displays the credentials username=alice&password=secret123. This is a clear demonstration of how easily unencrypted credentials can be captured.

Compare Options / When to Choose What

When sniffing credentials, you have several tool options. Here's a comparison to help you choose based on your needs:

For this lesson's purpose — focusing on passive capture of unencrypted credentials — Wireshark is the go-to because of its user-friendly interface and the robust Follow TCP Stream feature. However, if you're working on a remote server over SSH or need to automate repeated captures, tcpdump is more efficient. For future lessons that involve man-in-the-middle attacks, bettercap will be invaluable.

Troubleshooting & Edge Cases

Here are common problems and fixes you might encounter:

• No packets captured: Your Wireshark might be listening on the wrong interface. Use ip a or ifconfig to confirm which interface is active on your network, and select the correct one in Wireshark. Also ensure you have the necessary permissions (run Wireshark as root or add your user to the wireshark group).
• Credentials not visible in TCP stream: Ensure you're following the correct stream — sometimes a POST request is preceded by a GET, and the credentials might be in the body of the POST. Switch to "Show data as" raw if needed to see the entire content. If the server uses HTTPS, your capture will be encrypted; you'll need to use HTTPS decryption (with theserver's private key) — a topic for a more advanced lesson.
• Capture filter vs display filter confusion: Remember that capture filters (like tcp port 8000) limit what packets are stored, while display filters (like http.request.method == "POST") filter what is shown. If you used a capture filter that excluded your traffic, you won't see it. Set capture filters to port 8000 to capture only HTTP on that port.
• Steaming content breaks the stream: If the server sends chunked transfer encoding, the stream may appear garbled. Look for the username= and password= strings within the stream; they're usually sent in one chunk.
• Wireshark shows repeated packets: This is normal in promiscuous mode on a broadcast network. Use the display filter to keep only the relevant IP addresses: ip.addr == 192.168.1.10.

What You Learned & What's Next

Excellent! You've completed the sniff credentials on a local test network lesson. You now understand:

• The core concept of network sniffing: capturing plaintext packets to extract credentials.
• How to set up a controlled lab environment with a test HTTP server and use Wireshark to capture and analyze login requests.
• How to follow TCP streams to reveal usernames and passwords.
• How to troubleshoot common capture issues and the importance of network permissions.

This skill is foundational for ethical hacking — it's your first look into post-exploitation traffic analysis.

Your next step in the Ethical Hacking track is Man-in-the-Middle Attacks with Bettercap. In that lesson, you'll move from passive sniffing to active interception, learning how to redirect traffic through your machine and even perform SSL stripping to capture HTTPS credentials. This will build directly on your newfound sniffing abilities and expand your toolset to handle encrypted traffic scenarios.

Keep practicing in your lab — set up different protocols like FTP or Telnet and try to sniff their credentials. Remember: always stay ethical and use these skills only with explicit permission.