When Telnet does not negotiate its encryption extension or run through another protective transport, an attacker with a network position can read the username, password, commands, and output. An active on-path attacker who can observe and inject correctly sequenced TCP data may also attempt to hijack the established session. Confirm that the data stream is plaintext before treating passive capture as credential or content disclosure.
# capture Telnet from an on-path position
tcpdump -i eth0 -w telnet.pcap port 23
# follow the TCP stream to read credentials, commands, and output
Subtopics#
- Password sniffing: capturing credentials from the cleartext login.
- Command interception: reading commands and output in transit.
- Session hijacking: taking over the live Telnet session.