beecherbowers.com

Ever forget your email or ftp password, since your email or ftp program always remembered it for you? You are getting ready to leave for a trip, but can’t remember the password to check your email from the web? There’s a quick and easy way to recover these passwords using unconventional means.

POP Email account software and FTP (by default) send usernames and passwords in plaintext over your internet connection. While that is a security risk when away from home, it’s not a problem inside your home network(other than the usual wireless caveats). Here’s where you can do a little investigative work to capture your usernames and passwords.

Download a free program called What is Transferring (WIT, hereafter)and install it. It is a packet sniffer for your local computer. It can capture any traffic going in or out of your network connection. After installation, open the program and you will have a window that looks like this.

Notice the buttons in the top left corner. They’re the ones to stop and start the capture.

Open your email program and press the Play button in WIT. Press the button in your email program to force it to check for new mail. Press Stop in WIT. You’ll have a list of packets that were sent and received over your internet connection as shown below. You are interested in the traffic listed as Sent and the Destination Port of 110.(one sample highlighted below)

Look for the first line of traffic destined for port 110. Watch the lower pane in the WIT window as you click on each line of traffic going to port 110. Two of the captured transactions are important. You will find a USER XXXXXXX Where XXXXXX is your username and PASS XXXXXXX where XXXXX is your password. See below:

You’ve now captured both your username and password for your email. FTP is much the same, fire up WIT and your FTP client. Start capturing in WIT with the play button, and connect to your FTP site. Look for all traffic headed to destination port 21 to find your user/pass for FTP.