ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Sniff a plaintext login

Apprentice 10 pts

Goal: Catch the login form POST and read the password the browser sent in the clear.

Open Wireshark on your active interface and start a capture. Display filter for this level: http.request.method == "POST". No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in the POST body sent to /login. Open the POST and read the form body — username=admin&password=…. The password is the answer.

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

Filter for the submit: http.request.method == "POST".

Hint 2

Open the POST to /login and read the form body (Wireshark shows it under HTML Form URL Encoded).

Hint 3

The body is username=admin&password=…. That password is the answer.