User credentials are not encrypted when they are transmitted?!

I just built the website and then made the security scan by Acunetix Web Vulnerability Scanner which identified some hole in my website: "User credentials are not encrypted when they are transmitted". I guess that it means that someone who is able to monitor my website is able to capture someone's else username as well as password.

I would like to check this issue myself. Can you recommend me which tools I have to use in order to check this issue?!

I would like to check from a different computer, run some tools, and then log in with my personal computer in order to see if I can capture the credentials or not?!

I don't know what you call "monitoring your website" but the message means that creds are sent in plain text. A simple Mitm attack or decrypting wpa/wep packets, or capturing packet on an open wifi network would show them clearly.

You should use ssh to protect them. Well... Even that can be broken with sslstrip.

Hope this helps !

Which tools can I use in order to get a gateway of my uploaded website? Again, I would like to check if someone can do it from a different IP address?!

Quote:

---

Originally Posted by alex198555

Which tools can I use in order to get a gateway of my uploaded website? Again, I would like to check if someone can do it from a different IP address?!

---

Which tools can you use to get "what" again?

The simple tool traceroute can help you figure out what exactly your gateway is from the website. And simply watching the link actions while logging in will tell you whether or not encryption is activated. If "https" pops up during log in, then it's there. But I'm guessing you won't see it there because of the scanner you used. And it's probably not that hard to turn on encryption, but I've never put one up.

First I suggest using your eyes and brain. Does the login form require the use of SSL (HTTPS) or is it available without SSL (HTTP)? Does the login form action require the use of SSL (HTTPS) or is it available without SSL (HTTP)?

Second, fireup wireshark or ettercap, access the site via HTTP (not HTTPS) and record yourself logging in, then do a string search on the captured traffic for your username or password.

OK! Let's say I have my own website who has IP of AAAA.AAAA.AAAA.AAAA.

I check my website with some security scanner and it was figured out that "# User credentials are not encrypted when they are transmitted?!".

So, my laptop IP has the different IP address from my website like BBBB.BBBB.BBBB.BBBB.

The question is which tools may I use in order to capture the user credentials?! Which set of tools can be used to check or pen-test if my website is secure?!

So, I should be able to capture the user credentials from website's IP (AAAA one) by using laptop's IP(BBBB ones).

Waiting for your recommendations?!

Answer has already been given (cf. my previous post, and other's as well). Maybe it's time for some googling ;)

Quote:

---

Originally Posted by alex198555

OK! Let's say I have my own website who has IP of AAAA.AAAA.AAAA.AAAA.

I check my website with some security scanner and it was figured out that "# User credentials are not encrypted when they are transmitted?!".

So, my laptop IP has the different IP address from my website like BBBB.BBBB.BBBB.BBBB.

The question is which tools may I use in order to capture the user credentials?! Which set of tools can be used to check or pen-test if my website is secure?!

So, I should be able to capture the user credentials from website's IP (AAAA one) by using laptop's IP(BBBB ones).

Waiting for your recommendations?!

---

If your website is safe or not, will depend on the privileges of the hacked account. Maybe just the account will be compromised.

@alex198555 try reading! Answers to your questions appear in posts 6, 2, and to some degree 5.