Password sniffing

The Telnet login is cleartext, so a positioned attacker captures the username and password directly from the traffic, with no guessing and nothing logged on the server. Keystrokes are sent character by character, so the credential is reassembled from the stream, and the captured account is typically reusable.

1 min di letturaaggiornato il 5 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

When the Telnet data stream remains plaintext, capturing a real authentication can reveal the credential without password guessing or failed-login noise. Interactive input often appears as small segments or individual characters, so the client-to-server stream must be reconstructed. If the ENCRYPT option or another protective transport is active, this technique does not expose the plaintext password.

bash
# capture and reassemble a Telnet login from an on-path position
tcpdump -i eth0 -A port 23
# Wireshark: Follow TCP Stream reconstructs the full login (and session)
# reconstruct the first TCP stream from a pcap; select the relevant stream number
tshark -r telnet.pcap -q -z follow,tcp,ascii,0

Exploitation notes#

  • Reassembly matters: because input is per-character (and echoed), read the client-to-server bytes to recover what was typed; Wireshark's Follow TCP Stream and tshark do this directly.
  • This captures the real credential with nothing logged as a failed attempt, far quieter than brute force, so prefer it whenever a capture position exists.
  • The captured login is typically a device-administrative account and commonly reused on other systems and services; test it broadly.
  • Needs an on-path or tap position (ARP/DNS/route on a flat segment, a SPAN port, or a compromised intermediary).

References#

PrecedenteCommand interceptionSuccessiva Session hijacking