Credentials in the clear
A backup console still accepts HTTP Basic auth on plain HTTP. Find the login in the capture, decode it, and show why that service account password must be rotated.
Briefing
A network review found a backup console on 10.0.40.5:8080 that is not behind TLS. You captured a minute of traffic to it at /cases/backup.pcap.
HTTP Basic auth sends user:password in base64 in the Authorization header. Base64 is an encoding, not encryption, so anyone on the path can read it.
sensor-03 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.