And then another thing in a policy is to identify how many passwords are transmitted.
So even by having a strong password, if it's not carried securely, it can be exposed.
So while transmitting a password, the application should use encryption.
And this is, of course, HTP.
But not only passwords, but any other sensitive data such as payment information.
So this brings us to yet another problem that we're going to cover in session management.
HTTPS shouldn't only be used on login pages, but the entire application.
So go to Caleigh and open up your terminal and we're going to capture network traffic to watch for credentials
that are transmitted.
So open up Wireshark by typing and then open up your browser.
And I'm going to just get over here to the right side and go to the B Web login page.
Now, before you log in to be Web, start capturing the traffic on your network interface, so in my
case, it is either one, so I'll choose it and start to capture by clicking this icon on the toolbar.
And then go to the login page and her username and password and login button.
OK, so we logged in, so now let's go to Wireshark.
Now, here's a place that you apply display filters on the captured traffic, so simply type HTP to
view HTP traffic.
As you can see, the first line is the login request that we send.
Click it to choose and below you can display details about this line.
So under this, no, there are HDP related data.
And under this node, you will see the form data has been entered.
And you can see it is in clear text, so anyone on the same network can sniff this data.
You can also right, click on this line and follow the TCP stream.
And then view the HDP traffic data as we see it in berp.
OK, so now I'm going to close this window and stop capturing.
Let's return to the browser again, this time go to an HTTPS Web application and I'll just open the
Twitter login page.
And I'll get me a fresh capture.
OK, so enter in some login information here and log in.
And do you see Wireshark again as capturing the traffic?
But this is not raw htp, it is encrypted traffic.
So I'm going to filter SSL only traffic.
And you can see the protocol, it is to your last version, 1.0 to.
So this means the data is encrypted.
Choose a new line and from the below pane, open, secure socket, layer node.
And here is the encrypted application data sent over the network.
So if you followed TCP stream, you won't see anything, so obviously the point here is as a pen tester,
we need to check of the application data is sent over a secure channel or not.
All right.
So now we need to report and we can benefit from this finding as well.