I am posting username and password in a not secured web page (no https). While logging in to the my account I am using WireShark to try capturing my Post details. The result is that no Post message is captured. Why is that? (no ssl\tsl messages captured as expected - the site is not secured as I mentioned, but many tcp transportation on port 80) asked 19 Aug '13, 23:44  itay_user edited 19 Aug '13, 23:45 |
One Answer:
There are several possible reasons
So, please check the following
If you don't see any POST requests, please consider 1. and 2. of the list above. You could then just search for the username in the capture file.
Enter your username and let Wireshark search for that string in the whole file. As soon as it finds the packet, right click it and select "Follow TCP Stream". If Wireshark does not find the string it is either not in the capture file or the communication is encrypted. BTW: If the server is a public server, please post the URL, so we can test it ourselves. Regards answered 20 Aug '13, 01:27  Kurt Knochner ♦ showing 5 of 10 show 5 more comments |
http://newmail.walla.co.il/
Maybe the password is scrambled by javascript in the browser.
Only, if the traffic uses the standard https port (443).
If you follow the tcp stream that contains you username, what HTTP method is used there? GET or POST?
Well, that depends on internals of that site. If it uses javascript to scramble the password, you won't see it in cleartext in Wireshark. In that case the usual Browser Developer Tools will help.
No response from my location. Seems to be down right now.
I checked and saw that there are 5 Get packets from me to the server containing my username. So, you think that it all comes down to your last phrase? (the java script thing) If I'm right, then could you post here a guide for that?
maybe. I can't check as the site does not react when I try to access it.
It's up now.
well, if I do a test authentication, the whole traffic goes to friends.walla.co.il and is encrypted (TLSv1). So, that's the reason why you don't see the password. The main site does not use encryption, but the authentication form (together with javascript) uses SSL/TLS encryption.
could you please add more explanation? how does this process work? if the traffic goes from my computer to the unsecured server and from there to another one(secured), I should be able to see this traffic at the part of between my computer and the first server, no?
Well, that depends on the internal workings of that site. The best I can say: Please look at the HTML/Javascript code and learn more about web application design, especially about user authentication and session management ;-).
It is not that way. Your client loads the unsecured page. In the HTML/Javascript code there is 'link' to the secured page. So as soon as you submit the form, the form content will be sent to the secured server (done by your client). There may also be communication between the secured server and the unsecured server, however it is impossible to see that on your client.
You will see the traffic between the unsecured and the secured server on your client, if you use the right capture filter (all IP addresses of both servers) or no filter at all.