How to find cleartext credentials and weak authentication in a PCAP

Every network has a printer posting its admin password over HTTP, or a backup job logging in to FTP. Anyone who can see the traffic can read those credentials. A capture audit finds them before someone else does, along with the authentication that is encrypted but weak enough to crack.

1. Start with Wireshark's credentials list

Wireshark collects the credentials its dissectors recognise in Tools → Credentials. From the command line:

tshark -r capture.pcapng -q -z credentials

On a test capture it listed an HTTP Basic login and an FTP login, with the packet number for each. It doesn't look inside web forms, so a password posted from a login page won't appear. Run the checks below as well.

2. Check web logins

Over plain HTTP, two kinds of login are readable. Basic authentication sends the user name and password in a header, merely base64-encoded:

http.authbasic

Form logins send them in the request body. This finds posts with a field whose name looks like a password:

http.request.method == "POST" && urlencoded-form.key matches "(?i)pass|pwd"

Passwords in URLs end up in proxy and server logs as well as the capture, so check query strings too: http.request.uri matches "(?i)pass|pwd|token". Over HTTPS none of this is visible, and that's the point: the fix for every hit here is to move the login to HTTPS.

3. Check legacy clear-text protocols

Older protocols send credentials in clear text by design. One filter covers the usual suspects (tshark accepts it as written; in Wireshark’s filter bar, join it into one line):

ftp.request.command in {"USER", "PASS"} || pop.request.command in {"USER", "PASS"}
  || lower(imap.request.command) == "login" || smtp.req.command == "AUTH"
  || snmp.community || ldap.simple || telnet.data

• FTP, POP3 and IMAP: user names and passwords as plain commands.
• SMTP AUTH: credentials base64-encoded, unless the session upgraded with STARTTLS first.
• SNMP v1/v2c: the community string is effectively a password, and a write community controls the device.
• LDAP simple bind: an application logging on to the directory with an account's password in clear (ldap.simple holds it).
• Telnet: the whole session, keystrokes included. Use Follow → TCP Stream to read it.

4. Find weak authentication

Some authentication is encrypted but weak enough that a captured exchange can be cracked offline or replayed:

• Kerberos tickets with RC4 or DES. Filter kerberos.msg_type == 13 (service-ticket replies) and expand the ticket's enc-part: an etype of 23 is RC4, and 1 or 3 is DES. A service ticket encrypted with RC4 can be cracked offline to recover the service account's password ("Kerberoasting"). Don't filter on kerberos.etype alone: clients list RC4 among the types they offer even when AES is used.
• NTLMv1. ntlmssp.messagetype == 0x00000003 && !ntlmssp.ntlmv2_response finds NTLM logons without a v2 response, which means NTLMv1 or anonymous logons. NTLMv1 responses can be cracked quickly. ntlmssp.auth.username shows which accounts use NTLM at all.
• SMB1. The filter smb matches SMB1 only (SMB2 and 3 are smb2). SMB1 is the protocol behind WannaCry, and has been disabled by default in Windows since 2017.

5. Look for failed logons

A burst of failures is either a misconfigured service or someone guessing. These filters find failures in the main Windows authentication protocols:

kerberos.error_code in {6, 24} || ldap.resultCode == 49 || smb2.nt_status == 0xc000006d

Kerberos error 6 is an unknown user name, and 24 a wrong password. LDAP result 49 is invalid credentials, and the SMB status is a logon failure. Many accounts failing from one host suggests password spraying; many unknown names suggests user enumeration; one account failing endlessly is usually a stale saved password.

6. Fix and report

• Rotate first. Change every exposed password. The capture proves it crossed the network, and you can't know who else saw it.
• Fix the source: HTTPS for web logins, SFTP or FTPS for file transfer, IMAPS and POP3S for mail, LDAPS or StartTLS for directory binds, SNMPv3 for management, SSH for Telnet. Enable AES for Kerberos service accounts, and disable RC4, NTLMv1 and SMB1 once nothing depends on them.
• Report what, not the secret. Record the protocol, client, server, account name and time, never the password.
• Check again with a new capture after the change.

Manual method vs PCAPNG Analyzer