Hello and welcome to another video of this chapter in this video, we are going to
learn how to capture SMTP Password with Wireshark. Internet
Transfer protocol SMTP has been with us for many decades.
It uses PORT25 TCP and it's practically
open on every mail Server due to the backward compatibility.
There is also a secure alternative Port, which is four six four TCP. Most of the
Servers on port twenty five require start TLS command to
initiate the SSL TLS Encryption before any Authentication attempts been made.
However, mail servers within some
organizations will support Plaintext Authentication over an encrypted channel.
This is mostly due to legacy systems within their internal networks.
If somebody uses their Plaintext Authentication during a SMTP transaction,
a well-positioned Attack Keyboard nifty credentials.
All the Attack it has to do afterwards is to Base64 decode the username and
password, and this is because SMTP using Base64 encoding to encode the
username and password during this transaction.
So let's go to our Kali
Linux machine and see how this is done so back to our Kali Linux machine.
We are going to go ahead and
open Wireshark and afterwards we are going to go through open
are going to go to file open to open an already.
captured SMTP traffic.
As you can see, the file is small, but if you have a larger file, you can.
You can have larger file.
You can go ahead and apply display filter,
which is obviously going to be to be SMTP you hit enter
and then you go, you have all the SMTP transaction, all the smtp traffic.
So as you can see, if you go through each
line, you can see the ultimate gain and then you have to present.
Then you have to type your password, your username and then your password, and
then if the attempt is ok, you look into your SMTP to
your mail server, as you can see, you can see the password.
This is the Base64.
We were talking earlier at
the Base64 and then we were talking a little bit earlier on the slides.
This is the Base64 encoding of the password and the user name,
as we discussed earlier, as we mentioned earlier.
And you can just go ahead and click and
pick up from here or better if you go and do any of these lines right click follow
TCP stream and you can have it in Plaintext here.
So after the Auth login
we are presented with some Base64 encoding that the user has entered
looking into his email account, and we can basically use this one.
And next, it will be the password that he had that also in Base64 and encoding.
And we can use those two and
decode them and find out which username and password they used.
Please note that you can also use online tools to Base64 decode dot org or Base64
decode .net to do the decoding that you would like.
But you should also know that you should be careful with this because
perhaps you don't want to be disclosing any private credentials to other parties
on the Internet, specifically important during Penetration Testing and other
offensive exercises where sensitivity and privacy is crucial.
So please be aware of this and once we are in Kali Linux.
You can use the command line for that.
It's already embedded into Kali, so you can use Base64 command.
Then space dash d and then.
You're going to you're going to need.
You will have to
copy the user name and you can just paste it here under the command and then
you can see which username the user used, we can use the same command and this time
we are going to wipe away the user name and go back to our Kali Linux.
And go back to our Wireshark and copy the user name, which is the above line.
It is the below line from the
Password paste it here and then you can hit enter and this is the.
Password that we used to login without the
hashtag, of course galunt, and this is the Password.
So you saw how easy it is, at least in Linux, to decode the Base64 encoding of
username and password, the user used click into mail account.
That can be used, of course, for Phishing or Phishing attempts.
Now we have username and password for this e-mail account.
We can use it for any kind of Attack.
So that was it for this video.
And when you're ready, you can go ahead and click on the next video where you're
going to learn how to identify hosts and users with Wireshark.