Wireshark - View FTP usernames and passwords
by
Jeremy Canfield |
Updated: March 09 2020
| Wireshark articles
If the connection between the client and FTP server is not encrypted, Wireshark will show the username and password.
- Start a capture in Wireshark
- Connect to an FTP Server. Include your username and password in connection.
- Stop the capture in Wireshark.
- In the Wireshark filter, enter FTP.
- In the list of packets, the unencrypted username and password should be displayed.
On the other hand, if the connection between the client and FTP server is encrypted with a SSL/TLS certficate, Wireshark will not show the username and password.
Did you find this article helpful?
If so, consider buying me a coffee over at 
Comments
September 25 2019 by Gunnar Wolpe
Wouldn't one need to know the origination and destination IP addresses beforehand for this to work? If I'm connecting to my Web hosting service from some random IP address in the world, and I upload or modify the content at irregular intervals, sometimes with weeks of no activity, you might be waiting a long, long time, possibly forever, attempting to capture a session log-in.
October 16 2019 by Tim Erskine
I understand that the above is an assignment for the Pen Test Course, F19 course code: AL-ISS0111. I have clicked around within this assignment and it is unclear as to what I am required to do to complete the assignment. For certain I do not have a network to use Wireshark on so this assignment must be easier than I think. Can someone clarify and help me work through this assignment. Thanks.