Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark

POST /***URL*** HTTP/1.1
Host: ***DNS NAME***
Content-Length: 463
site2pstoretoken=***TOKEN***&ssousername=***MY USER NAME***&password=***MY PASSWORD***

This web site doesn't use TSL and is exposed to outer internet network.

Q1: Is it possible to sniff incoming traffic to that remote server (and get all the passwords)?

Q2: I think that's a security hole, am I wrong?

share|improve this question

migrated from stackoverflow.com May 25 '11 at 2:57

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 5 down vote accepted

A1: A man-in-the-middle attack would definitely be a good way to get this information (say if someone had access to a router / switch in the network).

A2: Yes, very much so. I'd get running on HTTPS as soon as possible.

share|improve this answer
    
+1 to man-in-the-middle attacks. this is so true in proxied environments... the admins can see all un-encrypted content that goes through it. –  Anonymous May 23 '11 at 13:42
    
Or public wifi hotspots that aren't encrypted or use WEP (i.e. with FireSheep). –  gravyface May 25 '11 at 3:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.