‫And then another thing in a policy is to identify how many passwords are transmitted.
‫So even by having a strong password, if it's not carried securely, it can be exposed.
‫So while transmitting a password, the application should use encryption.
‫And this is, of course, HTP.
‫But not only passwords, but any other sensitive data such as payment information.
‫So this brings us to yet another problem that we're going to cover in session management.
‫HTTPS shouldn't only be used on login pages, but the entire application.
‫So go to Caleigh and open up your terminal and we're going to capture network traffic to watch for credentials
‫that are transmitted.
‫So open up Wireshark by typing and then open up your browser.
‫I'm going to just dockett over here to the right side and go to the VoIP login page.
‫Now, before you logon to be Web, start capturing the traffic on your network interface.
‫So in my case, it is ethe one, so I'll choose it and start to capture by clicking this icon on the
‫toolbar.
‫And then go to the login page and our username and password and login button.
‫OK, so we logged in, so now let's go to Wireshark.
‫Now, here's a place that you apply display filters on the captured traffic, so simply type TDP to
‫view HTP traffic.
‫As you can see, the first line is the login request that we sent.
‫Quicker to choose and below, you can display details about this line.
‫So under this, no, there are HDP related data.
‫And under this node, you will see the form data has been entered.
‫And you can see it is in clear text, so anyone on the same network can sniff this data.
‫You can also right, click on this line and follow the TCP stream.
‫And then view the GDP traffic data as we see it in berp.
‫OK, so now I'm going to close this window and stop capturing.
‫Let's return to the browser again, this time go to an HTTPS Web application and I'll just open the
‫Twitter login page.
‫And I'll get me a fresh capture.
‫OK, so enter in some login information here and log in.
‫And do you see Wireshark again as capturing the traffic?
‫But this is not raw htp, it is encrypted traffic.
‫So I'm going to filter SSL only traffic.
‫And you can see the protocol, it is to your last version, 1.0 to.
‫So this means the data is encrypted.
‫Choose a new line and from the below pane, open, secure socket, layer node.
‫And here is the encrypted application data sent over the network, so if you followed TCP stream, you
‫won't see anything.
‫So obviously the point here is as a pen tester, we need to check of the application data is sent over
‫a secure channel or not.
‫All right.
‫So now we need to report and we can benefit from this finding as well.