Sniffing email passwords with Wireshark

> Open Wireshark.
 

> Select an interface and start capturing in promiscuous mode.
 

> To capture credentials from POP apply this filter:

pop.request.command == "USER" || pop.request.command == "PASS"

 

> To capture credentials from IMAP apply this filter:

imap.request contains "login"

 

> To capture credentials from SMTP apply this filter:

smtp.req.command == "AUTH"
%d bloggers like this: