Cryptographic Failures in Data Transit
Picture this: you are sitting in a coffee shop, connected to the free Wi-Fi, and you log in to your company portal to check your email before a meeting. Across the room, an attacker has opened Wireshark on their laptop. They are not doing anything sophisticated — they are simply watching the packets flow by. Within seconds, they see your username, your password, and your session token appear on their screen in plain, readable text. You have not been hacked. The application has simply failed to protect your credentials while they traveled across the network.
This is not a theoretical scenario. Unencrypted HTTP is still in use today, and the consequences are exactly as described.
Why HTTP Is Dangerous for Authentication
HTTP (Hypertext Transfer Protocol) was designed for simplicity, not security. It transmits every request and response as unstructured plaintext. This means that when you submit a login form over HTTP, your browser constructs a packet containing your credentials and sends it across every router, switch, and access point between you and the server — all in a format anyone can read.
On a shared network — coffee shop Wi-Fi, a hotel network, a corporate office where another employee has been compromised — passive packet capture is trivial. The attacker does not need to be your ISP or a government agency. They need only be on the same local network segment.
Base64 Is Not Security
Some applications attempt to obscure credentials by encoding them in Base64 before transmission. You may see a password field containing something like U3Vuc2gxbmU5OSE= and assume it is encrypted. It is not. Base64 is a text encoding scheme with no key and no secret. Decoding it takes one command:
echo 'U3Vuc2gxbmU5OSE=' | base64 -d
# Output: Sunsh1ne99!Any attacker who captures the packet can recover the original password in under a second. Base64 encoding provides a false sense of security and delays discovery only for the least technically capable observers.
What You Will Do in This Lab
In this lab you will step into the role of an attacker who has captured network traffic on a shared network. You will:
- Examine a simulated Wireshark packet capture containing 30 packets of mixed HTTPS and HTTP traffic.
- Identify and select the single unencrypted HTTP POST request to
/api/login. - Inspect the JSON request body to locate the Base64-encoded password field.
- Decode the Base64 value to recover the cleartext credential.
- Capture the flag embedded in the decoded output.
By the end of this lab you will understand exactly what an attacker sees when credentials are transmitted without TLS, why encoding is not a substitute for encryption, and what controls prevent this class of vulnerability.