The Challenge: Hunting for Hidden Secrets
Legacy applications, IoT devices, and misconfigured developer environments routinely transmit sensitive data in plaintext — long after the rest of the network moved to TLS. Finding these leaks during a forensic investigation or zero-trust audit means manually digging through millions of packets hoping to catch a credential before an attacker does.
HTTP Basic Authentication, unencrypted API calls, and session cookies travelling over port 80 are all invisible to standard firewall logs. The only way to find them is at the packet level — and doing that manually is slow enough that the damage is often already done by the time anyone looks.
Even after applying http.authbasic in Wireshark, the credential is still Base64 encoded. You have to copy the string, paste it into a decoder, and manually verify severity — for every single match.
Spotting XSS probes requires manually inspecting URL-encoded GET requests across thousands of HTTP packets to find malicious brackets (><) and evaluate the injection context — with no automated scoring.
The Solution: Automated Payload Inspection
PcapAI eliminates manual payload inspection and TCP stream reassembly entirely. Upload your capture and our deep packet inspection engine automatically calculates encryption ratios, extracts and decodes unencrypted credentials, maps every finding to the MITRE ATT&CK framework and lists the accounts to reset — with every secret masked.
-
✦
MITRE T1040 (Network Sniffing): automatically decodes plaintext logins in HTTP, FTP, Telnet, mail and database protocols. In the sample report,
192.168.0.4sent HTTP Basic credentials in cleartext to192.254.189.169— 31 reusable passwords in frames 58–641, readable to anyone on the path. - ✦ MITRE T1539 (Steal Web Session Cookie): flags the session data the same host sent over cleartext HTTP, so the response covers the sessions to revoke as well as the passwords to reset.
- ✦ Encryption Status Auditing: instantly calculates what percentage of traffic is plaintext versus encrypted, identifying exactly which internal hosts and ports are transmitting sensitive data unprotected.
-
✦
Masked Secrets: the report lists each exposed account with its secret masked (in the sample, account
testwithf******l) — keeping the finding auditable without exposing live credentials.
Wireshark Manual Analysis vs. PcapAI
Manual (Wireshark)
Applying http.authbasic filters, manually following TCP streams, and copying payloads into external Base64 decoders. Process takes 30–60 minutes.
PcapAI
Automated encryption ratio calculation, decoded credential extraction, and MITRE ATT&CK mapping with redacted report. Free summary in about two minutes for captures up to 20 MB.
How It Works
Upload Your PCAP
Drop any .pcap or .pcapng file — from an internal switch SPAN port, a firewall mirror, or a developer environment. No account required.
PcapAI Inspects Every Payload
Our engine follows every TCP session, decodes Base64 payloads, calculates encryption ratios, and flags XSS and injection probes — across the entire capture at once.
Get a Redacted Report
Receive a PDF with every exposed secret masked, MITRE ATT&CK mappings, and the exact source IPs to patch or isolate.
Frequently Asked Questions
How do you find HTTP Basic Auth credentials in Wireshark?
Apply the display filter http.authbasic to isolate Basic Authentication packets. The credentials are visible in the packet details pane, but remain Base64 encoded — you have to copy the string and decode it manually in an external tool to read the actual username and password. PcapAI automates this entire process: it finds, decodes, and flags every HTTP Basic Auth occurrence as a MITRE T1040 finding, with credentials masked in the report.
Why is cleartext traffic dangerous for compliance?
Plaintext traffic — any data transmitted without TLS encryption — can be read by anyone with access to the network path, including a compromised internal host performing passive sniffing. Passwords, session cookies, and API tokens transmitted over HTTP are trivially captured and reused for lateral movement. PCI DSS v4.0.1 requires strong cryptography for cardholder data sent over open networks (requirement 4.2.1), and NIST SP 800-53 covers transmission confidentiality in control SC-8. A cleartext login in a capture is a finding an auditor will ask about.
What protocols can expose plaintext credentials in a PCAP?
The most common sources of plaintext credential exposure in network captures are HTTP Basic Authentication (port 80), FTP (port 21), Telnet (port 23), SMTP without STARTTLS (port 25), and legacy LDAP (port 389). PcapAI automatically inspects all of these protocols in a single pass, flagging any instance where credentials or session tokens are transmitted without encryption — regardless of the port or protocol involved.
Can you recover credentials from an old PCAP file?
Yes — if the traffic was captured before TLS encryption was applied, the credentials are permanently stored in the PCAP and can be extracted at any time. This is why PCAP files containing sensitive traffic must be treated as highly sensitive artifacts. PcapAI can process captures of any age and extract plaintext credentials from historical traffic, which is particularly useful during post-breach forensics to understand what an attacker may have captured.
What tools find cleartext passwords in network traffic automatically?
Tools like Dsniff and Ettercap can extract plaintext credentials from live traffic, but require local installation and root access. For forensic analysis of an existing PCAP file, PcapAI automates the full process — decoding Base64 credentials, auditing encryption ratios, mapping findings to MITRE ATT&CK, and writing a report with every secret masked — with no installation required.
Related Use Cases
Are your internal apps leaking credentials?
Upload a PCAP from your internal network and find out before an auditor or an attacker does: the free summary takes about two minutes, and uploads without an account are deleted after 24 hours. Or see packs and plans.
Sample Report: Executive Summary
