OK, so I'll start another capture here
and then what I'll do on this web client is open up a browser to the tool box server, so
browse to the IP address of the server you can see here, it says Network is toolkit.
We can see information about Web server, FTP, TFTP, DHCP, syslog.
So various services are running on the server.
What we can do, however, is go to Wireshark and filter for HTTP and notice here we can see the protocol.
We can see as an example which browser was used, it's Mozilla five.
In other words, it's Firefox.
We can see that the server sent information back to the client servers using NGINX.
It's an Ubuntu server we can see.
Information about the server data that was sent to the clients, a notice network is toolkit.
That's what we see over here.
We can see
other information notice files located at and if I go to the right here
you can get to root after logging in and notice that's exactly what you see here.
So I've been able to capture what the user is viewing on HTTP server.
HTTP server is located over here.
So let's see if we can edit the HTTP server located in var.www.html.
So on the server cd var cd www cd html notice we've got the png file here and we've got index.
HTML. If I edit that
and add something to the text here.
So what I'll do is add some HTML here
and say this is a strong password in clear text.
Cisco, something like that, and then I'll save that file.
When I refresh that on the client, notice, we can see that text, but again, that's a really bad
idea because this is in clear text.
So
we can see that in Wireshark, HTTP is in clear text everything that you're watching can be sniffed and
can be read, including pictures.
So notice here we're getting a file from the server, in HTTP get means
send me that information.
Notice here as an example, the client is doing a get for GNS3.png.
In other words, it's trying to get the image.
The image is this image over here.
We could see as an example that that's the image hosted on the server.
So can we actually view that image?
Images sent from the server to the client over here, so png file or portable network graphics file is sent
to the client. What will do is
export packet bites
and I'm going to save this as a Wireshark capture.
I'll change that name to PNG
because I know it's a PNG file and then what I'll do is double click on that and notice that's the image
that I've saved.
So once again, I selected portable network graphics on notes, a graphics file, click export packet
bytes.
I'll give it a name such as Wireshark
capture 2 and click save
and then all I'm going to simply do is rename it as PNG, I know it's a PNG file
and double click on it
and there you go, there's my image.
So it was as simple as that as an example to capture information in HTTP, such as this clear text information
and PNG information.
Now, if the server was authenticating, the same thing would apply.
I'd be able to capture the username and password of the the network.
Be careful using clear text protocols.
Be careful using protocols such as Telnet, FTP, TFTP, and HTTP they were in clear text.
Anyone using Wireshark or a hacking application such as Kali Linux will be able to capture those passwords,
be able to read everything that you're sending on the network.