My work has a login system which doesn't use HTTPS. Login details are transmitted in plain text using HTTP Post.
I isolated the post request which sends the login details using wireshark, and found the username and password in the packets, in plain text.
Could an attacker listen the HTTP POST request wirelessly by being close to client's router or laptop somehow?
Is it even possible to sniff ambient WIFI transmissions by simply being in close range (If so, how)?
YES THEY CAN, Its call session hijacking.. There are sheer number of these Wifi hacker apps available on the internet. Most notably Wireshark and Interceptor-ng
YES.That the main goal of creating Https protocol Read this "HTTPS helps prevent intruders from tampering with the communications between your websites and your users' browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages." To prevent it use https and in our case use Vpn it will help encrpt you credentials.
