Because HTTP websites do not encrypt data, any information submitted—including passwords—travels across the network in easily readable plain text. Here is how you can use Wireshark to practically observe this vulnerability in action.

⚠️ Security Warning: You should only perform this test on a network you own or on a purposely vulnerable testing website. Capturing traffic on public networks or attempting to intercept other people’s credentials is illegal.

Step 1: Start the Packet Capture Open Wireshark and select your active network interface (the one with the fluctuating line graph, usually Wi-Fi or Ethernet). Click the blue shark fin icon in the top-left corner to begin capturing network traffic.

Step 2: Visit a Test HTTP Website Open your web browser and go to an unencrypted login page. For legal and safe testing, you can use intentional vulnerable sites like [http://testphp.vulnweb.com/login.php](http://testphp.vulnweb.com/login.php). Enter a set of fake credentials (for example, Username: testuser and Password: secretpassword) and click the login button.

Step 3: Stop the Capture Immediately switch back to Wireshark and click the red square icon in the top-left corner to stop the packet capture. This prevents the capture file from becoming overwhelmingly large.

Step 4: Filter for Login Traffic When you submit a form on a website, the browser typically uses the “POST” method to send the data to the server. To filter out the thousands of background packets and find your specific login request, type the following into the Display Filter bar at the top and press Enter: http.request.method == "POST"

Step 5: Inspect the Unencrypted Password

1. In the main packet list, you will now see a line that looks something like POST /login.php HTTP/1.1. Click on this packet once to select it.
2. Look at the middle pane (Packet Details) and scroll down to the section labeled “HTML Form URL Encoded: application/x-www-form-urlencoded”.
3. Click the arrow to expand this section. Under the Form item: dropdowns, you will clearly see the username and password you just entered, displayed in completely exposed plain text.

The “Follow HTTP Stream” Shortcut There is an even faster way to view this. Right-click on that same POST packet in the main list and select Follow > HTTP Stream. A new window will pop up showing the entire raw conversation between your browser (in red) and the server (in blue). If you look near the bottom of the red text, you will see your exact username and password string sitting completely unprotected.