How do I find my e-mail password hash in Wireshark?

Question

I use wireshark and I wanted (within education) get the password to my email.

I found the line

[truncated] Cookie: ... 

There is my login, but I do not know where the "hash" responsible for my password is. How do I recognize it?

Answer 1

Passwords sent through forms on HTML pages are not sent as hashes.

Usually, passwords are only stored as (salted) hashes in the database of your e-mail service provider. When you send your password through a form, and no other encryption technique is involved at the application layer, it is transmitted as-is over the network. It will be hashed at the remote server and that hash will be compared against the one stored in their database.

The following example is really simplified. Suppose Bob submits an HTML form with his username bob@example and his password foobar from the login page of his e-mail provider via an HTTP POST request. The web application will hash the password and look if the combination of hash and username exists in the database. If yes, Bob will be authenticated—his cookie will be set, and he'll be redirected to his inbox page, both via HTTP methods.

However, these days, when you enter a password in a form, the transmission will usually be secured by HTTPS as indicated by the lock in the URL bar of your browser, so the password doesn't go over the wire as plaintext.

So, in a nutshell: You can't find your password in a Wireshark dump, unless you entered it on a website that does not use HTTPS for transmitting data or you're using an e-mail client that connects to POP / IMAP without encryption.