Traffic interception

Telnet is unencrypted, so a positioned attacker reads everything: the login and password, every command typed, and all output, and can hijack the live TCP session to inject commands as the authenticated user. Interception is often the easiest Telnet attack where a network position exists, needing no credential guessing.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

When Telnet does not negotiate its encryption extension or run through another protective transport, an attacker with a network position can read the username, password, commands, and output. An active on-path attacker who can observe and inject correctly sequenced TCP data may also attempt to hijack the established session. Confirm that the data stream is plaintext before treating passive capture as credential or content disclosure.

bash

# capture Telnet from an on-path position
tcpdump -i eth0 -w telnet.pcap port 23
# follow the TCP stream to read credentials, commands, and output

Subtopics#

Password sniffing: capturing credentials from the cleartext login.
Command interception: reading commands and output in transit.
Session hijacking: taking over the live Telnet session.

Traffic interception

Subtopics#

References#