Home > Network Pentesting

Intercepting Credentials & Traffic

Intercepting credentials and traffic is the primary goal of most MITM attacks. Once the attacker is positioned between the victim and the gateway, all packets flow through the attacker’s system. This allows capturing plaintext credentials, session cookies, unencrypted data, internal service requests, and even metadata from encrypted connections. Effective interception requires monitoring specific protocols, identifying authentication flows, and using tools that extract meaningful information from live traffic.

How Traffic Interception Works

During MITM, attackers forward traffic while recording it. Any protocol that does not use strong encryption becomes visible. Even encrypted traffic reveals valuable metadata such as domains, certificate info, and traffic patterns.

Intercepted data often includes:

  • HTTP logins

  • Session cookies

  • DNS queries

  • FTP credentials

  • POP3/IMAP/SMTP logins

  • SMB traffic

  • API tokens

  • Internal hostnames

Capturing Live Traffic with tcpdump

tcpdump captures raw packets directly from the network interface.

Capturing All Traffic

sudo tcpdump -i eth0

Capturing HTTP Credentials

sudo tcpdump -i eth0 port 80

Saving Traffic for Analysis

sudo tcpdump -w capture.pcap -i eth0

Pentesters later inspect the .pcap file in Wireshark.

Analyzing Traffic with Wireshark

Wireshark provides protocol decoding and credential extraction.

Common filters include:

  • http

  • ftp

  • smtp

  • dns

  • tcp.stream eq X

Wireshark automatically highlights:

  • Username/password fields

  • Cookies

  • Host headers

  • URLs

  • Query parameters

HTTP POST requests often reveal login details in plaintext.

Intercepting Credentials via ARP MITM with Bettercap

Bettercap automatically extracts sensitive data from intercepted traffic.

Starting Bettercap

sudo bettercap -iface eth0

Enabling Sniffing

net.sniff on

Printing Credentials

events.stream on

Bettercap displays captured credentials in real time.

Extracting Credentials from FTP

FTP transmits usernames and passwords in plaintext.

Filtering FTP Traffic

sudo tcpdump -i eth0 port 21

Wireshark filter:

ftp.request

Credentials appear in:

  • USER command

  • PASS command

Extracting Emails from POP3, IMAP, and SMTP

Older mail protocols often send logins in plaintext.

POP3 Traffic

sudo tcpdump -i eth0 port 110

IMAP Traffic

sudo tcpdump -i eth0 port 143

SMTP Authentication

sudo tcpdump -i eth0 port 587

Wireshark decodes these protocols clearly.

Capturing SMB and NTLM Hashes

SMB authentication exposes NTLM hashes through challenge–response flows.

Capturing Hashes

sudo tcpdump -i eth0 port 445

NTLM hashes extracted can be used for:

  • Offline cracking

  • Pass-the-Hash attacks

  • Lateral movement

Intercepting Cookies and Sessions

If SSL stripping was successful, session cookies are exposed in HTTP.

Wireshark Filter

http.cookie

Captured session cookies allow:

  • Session hijacking

  • Account takeover

Intercepting DNS Queries

DNS is always plaintext unless using DNS-over-HTTPS.

Capturing DNS Traffic

sudo tcpdump -i eth0 port 53

DNS leaks:

  • Internal hostnames

  • User browsing behavior

  • VPN domains

This helps map internal infrastructure.

Extracting Credentials with Ettercap

Ettercap includes protocol parsers that automatically extract credentials.

Running Ettercap

sudo ettercap -T -M arp /victim/ /gateway/

Captured credentials appear in real time.

Intercepting HTTPS Metadata

Even when HTTPS content cannot be decrypted, valuable information can be collected:

  • Target domains (SNI)

  • Certificate subjects

  • TLS versions

  • Cipher suites

Capturing TLS Handshakes

sudo tcpdump -i eth0 port 443

This assists in fingerprinting services and detecting outdated TLS versions.

Why Interception Matters

Credential and traffic interception exposes:

  • Weak protocols

  • Poor encryption

  • Misconfigured applications

  • Internal service credentials

  • Sensitive corporate data

Interception is a critical phase in evaluating real-world risks, identifying clear-text leaks, and demonstrating the impact of MITM vulnerabilities.

Intel Dump

  • Interception relies on MITM position

  • Tools: tcpdump, Wireshark, Bettercap, Ettercap

  • FTP, POP3, IMAP, SMTP, SMB often expose credentials

  • HTTP reveals logins and cookies

  • NTLM hashes enable pass-the-hash

  • DNS leaks internal network structure

HOME LEARN COMMUNITY DASHBOARD