Wireshark-users: Re: [Wireshark-users] Hello

From: Martin Visser <martinvisser99@xxxxxxxxx>
Date: Tue, 7 Jul 2009 17:00:13 +1000

Sergio,

The kpasswd field is only relevent for Kerberos passwords, such as you would be using when authenticating against Microsoft Active Directory, so it is not relevant for web-based authentication.

If the password is a field submitted via a HTTP GET or POST method then it probably can be found via a filter something like:-

http.request.method == POST && (data-text-lines contains yourpassword)

http.request.method == GET && (http.request.uri contains contains yourpassword)

Of course best practice would see that any passwords are protected via SSL (HTTPS) so you may not see a lot unless you have access to the server's SSL certificate private key.

Regards, Martin

MartinVisser99@xxxxxxxxx