Now that we've got Wireshark installed and we've got our adapter set back to the private host only network,
the box net zero, and we've turned that Ethernet adapter, that network adapter to promiscuous mode
and advanced, we're ready to let's go and shut down Wireshark if you still have it running since we
changed the interface.
And let's start Wireshark back on that Windows 10 computer.
Then we can go to capture.
Come to options.
And we'll just make sure that we're connected to that Internet and it's in promiscuous mode, that's
going to be OK clothes.
So we're ready to capture an wireshark now.
We need to make sure that we have our utility Sorrow and Métis floatable to running.
We're actually going to log into MUTILATOR, but we're going to try our Métis floatable to all you need
to do is the if config.
And that is it tendo 3:00 to 5:00 and we should be listening that Tenga three hosts only network, so
10 that three to five for me, if yours is different, that's fine.
Open your Windows seven box and we're going to open up a browser.
And let's surf to 10 dot o dot three, dot five.
We can see how Métis voidable box is up and running and manipulatable is going to be really useful when
we do Web hacking, but we're going to demonstrate how we can capture a plaintext password if it's sent
out over an unencrypted channel across a network.
Anybody who's connected to the network that Windows 10 machine is completely separate from these other
two computers.
Anybody connected to your network can sniff your passwords if you send them unencrypted.
So let's see that happen.
First of all, come down to mutilator.
A Utility is a terrific application for learning various Web exploits so you can try different types
of attacks.
It's an attackable platform mutilate utility born to be hacked.
Let's go to the login register page.
So we've logged in to wear on our Windows seven box, but we've actually logged in to our metastable
server and we've clicked through the utility because it is a good log in register page so we can reset
the DB That'll be handy for us as well and come back to log in register.
I'm going to go ahead and start my log in, I'm not going to press log in, but I'll say Fred and my
password is Wilma, you can log in to another service if you wanted to.
You could log into anything that doesn't require an encrypted connection.
The key to this is that if you ever log in into an HTP server, whether that's your WordPress server
and you do your dash log in over HTP, or if you log in to your school's email, your work e-mail over
an unsecure connection, your password is being sent over a huge network, just like the one we're about
to see here.
So this is a small network with just three computers running on it right now.
But I've got my Windows seven computer ready to log in to this login page that is not secure on my Métis
floatable server.
Hold it right there.
We're going to come over to Windows 10 that's running our Wireshark and we're going to start the packet
capture press start.
And now Windows 10 is going to be listening for packets.
Let's send it a packet will log in with Fred and Wilma.
Notice it's asking if we want to remember the password.
No, we don't.
So when we run this, we're going to see that it needs the database set up.
But that's OK because we have sent our login information.
Switch back to Wireshark and press.
Stop.
So on a Windows team computer, we're stopping Wireshark now, all we need to do is, well, first,
let's say this, these captured packets file save as so I'm just sniffing it at work.
I see somebody logging in on a computer over someplace else that Windows seven computer someplace across
the coffee shop or any place that doing security testing.
I'm going to call this log in traffic because I think somebody logged in and we'll use the pickup in
format press save.
So we've got these packets that we can come back and look at later, but let's go ahead and go to edit
find packet.
And let's change this to string and see if we can find.
Well, a lot of times on our website posts or Sin's a form to a server, it uses the post command or
the post format.
So let's see if we can find post and we may see a few down here.
Look look at this one highlighted right here.
There's a post from a ten point three dot for that must be one Windows seven computer to ten dot dot
three to five.
That is my utility, my and my utility Web site running on the splitter box.
And notice it's an HTP post and it's trying to post a login so we could also search for log in as a
string.
But if you know how Web forms work, Post is a really good one.
So if I click on this packet and if I double click.
I'm going to see that it had an HTP form or HTML form, if I expand that, look at the information that
went across this network, Fred, and a password of Willmar and attempted to log in.
Wow.
That should scare you if you ever log into a Web site that doesn't have HTP.
And that little luck symbol lets you know that the site is secure, that it's encrypting that traffic
before it sends it out, you need to know that you are sending usernames and passwords in plain text
across a network.
I'm on a completely different computer that just happens to be connected to the same network.
And I can see Fred and Wilma as plain as day.
So if those were my username and password for that remote server, my meds floatable server, I would
have just given that out in plain text on the network.
That's almost like putting a Post-it note on your monitor with a username and password for your favorite
Web site.
So let's look through this packet a little bit down below and see we can see the individual characters
in that packet.
And if you scroll down here, you can see password equals Wilma.
It's all right there, password equals Wilma, so there's a whole lot of other digital information that
was sent in this packet, you can see that.
Tells the location of the form, tells what kind of information it accepts and a lot more, but the
key word that we were looking for was our password.
And we found that just by looking for information that had been posted to a Web server, you can also
when you get good at using Wireshark, you can search for strings like Pass or Password or TWD and you
will turn up a lot more like this.
It just turns out that our very first form posting we captured just for a little bit that we didn't
have to do very much searching because we captured Rudd is that user was clicking log in, then we stopped
our capture, saved everything, and now we can surf through that packet.
That individual packet was sent notice.
There's a whole lot of packets that were sent and some even had posts in them.
But we were lucky to turn up that post.
Mutability going to attend at three point five pretty quickly.
There's one more set of skills that we need to flex to understand why it's important to have good passwords
and why it's important to protect those passwords with good security.
And we'll see that in the next lesson.
Then we'll do a wrap up and see some tips on how you can avoid having your passwords taken the way that
we've shown in these lessons so far.