Home > Network Pentesting

Credential Extraction

Credential extraction focuses on recovering usernames, passwords, hashes, tokens, and authentication material from captured packets, live traffic, and insecure network protocols. During network pentesting, this phase reveals how credentials move across the network, which services leak sensitive data, and how attackers escalate once they obtain login information. Extraction is possible on unencrypted protocols, partially encrypted channels, and even encrypted sessions through metadata or challenge–response mechanisms.

Extracting Credentials from HTTP

HTTP exposes credentials when login forms use plaintext connections.

Capturing HTTP Traffic

sudo tcpdump -i eth0 port 80

In Wireshark, filter:

http.request.method == "POST"

Inspect POST bodies for:

  • username

  • password

  • tokens

  • cookies

Session cookies often allow full account takeover.

Extracting FTP Credentials

FTP transmits both username and password in plaintext.

Capturing FTP Login

sudo tcpdump -i eth0 port 21

In Wireshark, filter:

ftp.request

Look for:

  • USER <username>

  • PASS <password>

These appear clearly in the packet stream.

Extracting POP3, IMAP, and SMTP Credentials

Older email protocols leak credentials by default.

POP3

sudo tcpdump -i eth0 port 110

IMAP

sudo tcpdump -i eth0 port 143

SMTP (Auth)

sudo tcpdump -i eth0 port 587

Wireshark decodes these protocols and shows authentication fields directly.

Extracting SMB / NTLM Hashes

NTLM challenge–response traffic reveals password hashes that can be cracked offline or used directly.

Capturing NTLM Traffic

sudo tcpdump -i eth0 port 445

Wireshark filter:

ntlmssp

Extracted elements include:

  • NTLMv1 hashes

  • NTLMv2 hashes

  • Domain

  • Usernames

These hashes support:

  • Pass-the-Hash

  • Offline cracking (Hashcat)

  • Lateral movement

Extracting Kerberos Tickets

Kerberos authentication leaks valuable metadata and tickets.

Capturing Kerberos Traffic

sudo tcpdump -i eth0 port 88

Wireshark filter:

kerberos

Useful extractions:

  • TGT requests

  • Service tickets (can be cracked if RC4 used)

  • Usernames and SPNs

  • Ticket encryption types

Weak encryption enables Kerberoasting.

Extracting DNS-Based Credentials

DNS tunneling or misconfigured systems may leak:

  • API keys

  • Tokens

  • Base64-encoded data

  • Internal hostnames

  • Device authentication attempts

Capturing DNS Traffic

sudo tcpdump -i eth0 port 53

Suspicious long or random-looking subdomains often contain encoded data.

Extracting Credentials from TLS Metadata

Even though TLS encrypts payloads, metadata reveals:

  • SNI domain

  • Certificate subject

  • Client auth attempts

  • Weak cipher usage

  • Session resumption behavior

Capturing TLS

sudo tcpdump -i eth0 port 443

While credentials are not visible, misconfigurations enable downgrade or MITM attacks.

Extracting Credentials with Bettercap

Bettercap automatically detects logins from many protocols.

Enabling Sniffing

sudo bettercap -iface eth0
net.sniff on
events.stream on

Bettercap extracts:

  • HTTP logins

  • FTP credentials

  • POP3/IMAP logins

  • SMTP auth

  • Cookies

  • Basic Auth headers

It displays credentials in real time.

Extracting Credentials with Ettercap

Ettercap supports protocol parsing and detects plaintext logins.

Running Ettercap MITM

sudo ettercap -T -M arp /victim/ /gateway/

Captured credentials appear in the console.

Extracting Tokens and API Keys

Many applications transmit:

  • JWT tokens

  • Bearer tokens

  • Session cookies

  • API keys in headers

  • OAuth codes

Wireshark filter:

http.authorization

These allow full account access even without passwords.

Extracting Credentials from PCAP Files

Offline analysis allows slow, deep inspection of traffic.

Opening PCAP in Wireshark

Look for:

  • Protocol dissections

  • Reassembled TCP streams

  • Credentials inside form data

  • NTLM challenge–response

  • DNS queries with encoded data

Offline analysis is often more thorough.

Why Credential Extraction Matters

Credential extraction exposes weaknesses in network design, application security, and authentication protocols. It reveals:

  • Unencrypted logins

  • Weak challenge–response systems

  • Password reuse

  • Poor protocol choices

  • Misconfigured secure services

Extracted credentials often lead directly to:

  • Lateral movement

  • Privilege escalation

  • Domain compromise

  • Full system takeover

Intel Dump

  • Credentials leak through HTTP, FTP, SMTP, POP3, IMAP, and SMB

  • NTLM and Kerberos provide hashes and tickets for cracking

  • Tools: tcpdump, Wireshark, Bettercap, Ettercap

  • Session cookies, JWTs, and API keys often grant access

  • Credential extraction is critical for evaluating real-world risk

HOME LEARN COMMUNITY DASHBOARD