How easy to sniff a public FTP/HTTP username and password?

Hi IT Colleagues,
I understand that using plain FTP/HTTP , it is possible to sniff username and password using sniffer like wireshark.
However, I just to want know how easy to do it.
I know that in order to sniff , you should be in the same network or subnet as the website or ftp site.
Regards,
Jhun

It is trivially easy to sniff credentials out of FTP and HTTP due to the fact there is no encryption at play. One should also not simply consider the risks of someone running a sniffer on your local area network, or on the local area network of the remote
server, website or ftp site, but should consider the possibility for traffic to be sniffed along the way. The NSA is doing a rather good job of sniffing all of our traffic, credentials and all! Don't just worry about someone like the NSA though, a malicious
user on an ISP network, or an administrator of a proxy server could just as easily sniff the plain text traffic.
Kieran Jacobsen @kjacobsen http://aperturescience.su

Similar Messages

How do I stop Firefox from filling in usernames and passwords when other people use my computer?

When other people use my computer, how do I stop Firefox from filling in usernames and passwords?

*Click the (empty) input field on the web page to open the drop down list
*Highlight an entry in the drop down list
*Press the Delete key (on Mac: Shift+Delete) to remove it.
Remove saved Password(s):
* Tools > Options > Security: Passwords: "Saved Passwords" > "Show Passwords"
Password Manager:
*http://kb.mozillazine.org/Password_Manager

[Deployment] How NOT to hard code the Database SID, Username, and Password

Hi, I'm new in J2EE so be easy on me. :)
How can I parameterize the database SID, username, and password in my J2EE application? So that anyone can change the SID, username, and password without the need to modify my code? I use Oracle 10g, ADF BC, JSF and JDeveloper 10.1.3.1.
My friend said that I can use XML for this. But he didn't go to detail for doing this. Is it true? Is there any [or better alternative]?
Any help or pointer to a simple tutorial would be fine.
Thanks in advance.

Hi -- this is quite easy to do with J2EE.
In your application code, you declare "logical" references to resources (such as datasources, security roles, etc.) and use those in your application code so all it depends on is the logical name
On the server where the application is deployed, "physical" resources are created that point to the actual resource -- in the case of a database, this would be the JDBC URL, username, password.
At deployment time of the application, you then use the facilities of deployment tool to "map" the logical references in the application, to the physical references that exist on the server. So you connect the dots between your application needing something and the server providing the something. That way all the "details" are abstracted out of the your application code.
I don't know how this works in ADF, BC4J, etc. but I presume that since they are based on standard/J2EE, it must be available somehow.
I wrote something about this a while back using direct JDBC as an example:
http://buttso.blogspot.com/2006/06/datasource-lookup-using-javacompenv.html
-steve-

How do I get Firefox to remember two usernames and passwords for att.yahoo?

Firefox remembers one username and password, does not auto-fill-in the information (which is good), but will not ask to remember the second username and password. How do I get Firefox to remember the second username and password?
I have two e-mail accounts which use the same login page, one account is sbcglobal and the other is yahoo. I would like Firefox to remember both sets of information so I don't have to type all the username and password information for one account.

* Make sure that you not run Firefox in (permanent) [[Private Browsing]] mode
* You are in Private Browsing mode if you see "Tools > Stop Private Browsing", possibly grayed
* You enter Private Browsing mode if you select: Tools > Options > Privacy > History: Firefox will: "Never Remember History"
* To see all History settings, choose: Tools > Options > Privacy, choose the setting <b>Firefox will: Use custom settings for history</b>
* Uncheck: [ ] "Automatically start Firefox in a private browsing session"
See also http://kb.mozillazine.org/User_name_and_password_not_remembered

How to secure word docs, access only via username and password?

I have created a CMS (Content Management System) where
residents can access publicly made available word documents
uploaded via the web by authourised members of a residents
association. (no password needed)
password only needed to upload
I have also created a section for excecutive members only
where documents for coming meetings are kept, but are not yet
available to general residents. (password is needed to view these)
All works fine apart from the executive section, all the
documents seem to get 'spidered' no matter what is in the robot.txt
file.
this i know as i have been tracking visitors to it.
the pages are not yet live or in use as i want to be sure
that these 'not for public viewing' file are not viewed until they
are in the public folder.
each section will have their own folder, but google has
'spidered' all pages! it seems that google and other sites are not
taking notice of the robot.txt, i have read on some sites that this
is common. how they do this is beyond me, i though that you could
only spider a site that had a home page and that you follow all
links contained within this initial page.? seems that this is not
the case.
what other methods can i try out that will protect these
files.
(please do not reply with, do not put them on the site!) i
have had this with other forums in the past.
only sesible answers please.
and thank you in advance for your time.

i have been busy looking around but not finding anything.
My PHP scripts at present accept the word docs and store them
in folders, lets say, www.site.com/secretfolder/...
One suggestion is to have them in a database, this is not
idea, but is going to be the last resort.
the idea i like most is to have the outside the root www
folder.
what i am not sure of is how i allow access to them if normal
access can not be used. i.e. www.site.com/myfolder/file.doc
one way that has been suggested is streaming but this
completely eludes me, i first thought streaming was for sound and
video, but that aside, please can someone provide some links to
sites that show some examples or more information on how i do this.
i do not need the file to be uploaded as i can change my
scripts to upload to the new folder that is outside the root www
folder, what i do not understand is how i get the file back from
this outside root folder to the user that is wanting to view it.
my way of thinking is to create a temp folder inside the www
folder but this means that the files will then be available to the
robots again and if i was to have the folder cleaned after the file
is taken what happens if the server or the persons pc was to crash
or something, then the script will not complete and the file will
still be available to view by the robots.
or is their another way

How to create a login funtion with different usernames and password to iweb

Hi,
Im looking for hours for a solution to create / add a function to iweb which allows users to login to a member area with their own user names and passwords.
Is there a simple way to realize this? So far I know there has to be a file with all the user name --> password combinations, can I add such a file to my idisk and then get it working with my iweb site?
Is such an idea in general possible with iweb?
Thanks for your help!
Message was edited by: Macusar08

One possibility may be to use the free drop.io to privately share links to your iWeb site pages and/or iDisk files. +"Each 'drop' (...) can be password-protected and set to expire after a period of time, so you can share exactly what you want with whom you want for as long as you want."+ (source).
Note that drop.io doesn't require an email address, name or personal registration to set up a "drop". And you can place data in either one drop or multiple drops. Each drop comes with 100mb of storage for free and you can have as many drops as you want without signing up.

How to access to SSO username and password from JPDK

Hello
Does anybody know how to access, from Java PDK, to SSO username
and password of user, currently connected to portal.
Thank's,
Tomaz Podbersic

The portal user's password is one way hash algorithm (MD5) that
cannot be reversed.
What you'll have to do is setup a "External Application" and
save an alternate username/password profile in that area. It
requires the user to first enter that data (but only 1 time) the
first time into that application.
===========================================
<HELP NOTE>
If anyone knows of an API to populate those tables when seeding
or creating the user names to also seed or create the "external
applications" user /pass this would be helpful.
============================================
JSP java code:
====================
PortletRenderRequest portletRequest = (PortletRenderRequest)
request.getAttribute (HttpProvider.PORTLET_RENDER_REQUEST);
ProviderUser myUser=(ProviderUser) portletRequest.getUser();
=====================
From this object instance you can get the user's name, and other
Portal session info. NOT password.
The External Application username & password is a bit more
tricky to get.
see:
SQL Login Problems

TS1702 How do change the old Apple ID username and password to the updated username and password for the apps store?

How do you change the old Apple ID username and password to the updated username and password in order to get updated apps from the app store?

cbkitche wrote:
How do you change the old Apple ID username and password to the updated username and password in order to get updated apps from the app store?
Do you mean you kept the same account but you only updated your AppleID?
Just log out and log back in with new ID.
Note that the AppleID is embedded into the item at purchase and cannot be changed.
However, when you change your AppleID, it will link the old account name to the new account name so you will not have any problems updating apps using the new AppleID.

How can I change the admin username and password

how can I change the default admin adminadmin username and password for the server

What version of Creator are you use?
In Creator 2 Update 1, using Application Server version 8.2, you can do the following..
1) Log into the Admin Console using the default UID/PWD
2) Expand the tree view by following this path:
Application Server > Configuration > Security > Realms > admin-realm
3) Click on "Manage Users"
4) Click on the UserID "admin"
5) enter the new password that you would like
6) Click on the "Save" button on the upper right side of the page.
That should do it for you.
Good luck

Reg : How can I get Username and Password in FTP Server in HANA

Hi All,
Any one can you please guide me....How can i get username and Password of FTP Server in SAP HANA?
Regards,
Arjun

Hi Arjun,
Are you looking for external authentication(External ID option) in HANA Studio instead of logging by entering HANA User and Pwd(which is internal)?
You can look for the following Security guide which will give you some insight on this.
http://help.sap.com/hana/hana1_sec_en.pdf
Rgds,
Murali

How set UserName and Password for HTTP Basic Authentication for a servlet

Hi..
How set UserName and Password for HTTP Basic Authentication for a servlet in JBoss server?
Using Tomcat i can do it .(By setting roles in web.xml, and user credintails in tomcat-user.xml).
But i dont know how do it in JBOSS..
I am using Netbeans and Eclipse IDEs.. Can we do it by using them also!?
Thank u

Hi Raj,
You can do this by creating a Login screen for the users and check the authentication of each user in PAI i.e. PROCESS AFTER INPUT.
Store the user information in a database table and check the username and password when the user enters it.
You can display password as *** also. For this double click on input box designed for password and goto Display tab. Select Invisible in the list and check it.
CASE sy-ucomm.
    WHEN 'BACK'.
      LEAVE PROGRAM.
    WHEN <fcode for submit>.
      SELECT SINGLE uname pwd
       FROM <DB table>
       INTO (user, pass)
       WHERE username = user AND
               password = passwd.
      IF sy-subrc = 0.
<Go to next screen for further processing>
      ELSE.
<Display Error message and exit>
      ENDIF.
ENDCASE.
Regards,
Amit
Message was edited by:
        Amit Kumar

How to give Username and password when calling HTTP page?

I have this code when i run this I get credentials error. How to give credentials .The authentication is set to windows in the https page. Means pop up will appear to get the credentials
declare
req UTL_HTTP.REQ;
resp UTL_HTTP.RESP;
value varchar2(1024);
p_url varchar2(4000);
OPT varchar2(1000);
BEGIN
dbms_output.put_line('');
p_url:='http://www.xyz.com/';
dbms_output.put_line(p_url);
req := UTL_HTTP.begin_REQUEST(p_url);
utl_http.set_header(req, 'User-Agent', 'Mozilla/4.0');
resp := utl_http.get_response(req);
loop
utl_http.read_line(resp, value, true);
dbms_output.put_line(value);
end loop;
exception
when utl_http.end_of_body then
utl_http.end_response(resp);
END;
When i run this i get
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>
<style type="text/css">

Basic authentication is set using the UTL_HTTP.Set_Authentication() call.
If you are using a proxy and need procy authentication, you can set the username and password for proxy access, as part of the proxy URL. E.g.
utl_http.set_proxy( 'http://proxyuser:[email protected]', null );NTLM (Windows NT LAN Manager) authentication is proprietary and not part of the HTTP specifications. If that is needed, try and use the username and password as part of the URL - or do some research on how to manually perform NTLM authentication.
If you are using HTTPS, you need an Oracle Wallet with that server's certificate (making it a trusted certificate), and then set/use the wallet using the UTL_HTTP.Set_Wallet() call. See sample code in {message:id=10820182}.

Firefox does not automatically load nor find the login page for a public network (i.e. username and password)

To log in on a public network without a password-key (not secured), a user login is required.
After connecting to the network, the browser, upon opening it, normally automatically loads the login page, in order to enter a username and password and connect to the internet.
Firefox doesn't find the login page automatically, so I need to switch to google Chrome just to log in to the network.
Does this have anything to do with user settings in the options of firefox?
Any ideas?
thx!

Hi,
You can try setting the login page as the [https://support.mozilla.org/en-US/kb/How%20to%20set%20the%20home%20page Home page] and choose to '''Show my home page''' beside '''When Firefox starts:'''.
Alternatively, and/or to preserve your current settings you could also pin it as an always present one-click away [https://support.mozilla.org/en-US/kb/what-are-app-tabs App tab].

How can I pass username and password in a client bean to call a webservice?

Hi,
I have created a Client Java Bean for a web service (an automatically created Service from a Bapi) that requires username and password. How can I pass username and password in the code?
Thank you!
Julia
This is my code:
public Z_FlightGetlist port;
Business Method.
public String test1234() {
try{
BAPI_FLIGHT_GETLIST list = new BAPI_FLIGHT_GETLIST();
list.setAIRLINE("KLM");
port.BAPI_FLIGHT_GETLIST(list);
return "ok";
catch(Throwable e){
return "error"+e;
public void ejbCreate() throws CreateException {
try{
InitialContext ic = new InitialContext();
Z_FlightGetlistService s = (Z_FlightGetlistService)ic.lookup ("java:comp/env/FlightProxy");
Z_FlightGetlist vi = (Z_FlightGetlist)s.getLogicalPort(Z_FlightGetlist.class);
this.port = vi;
catch(Throwable e)

Hello Julia,
Check this document
http://help.sap.com/saphelp_nw04/helpdata/en/50/a5d13f83a14d21e10000000a1550b0/frameset.htm
Best regards, Maksim Rashchynski.

Passing username and password while calling the simple HTTP API

Hi,
I want to execute a graph by calling the http api from a java code. However, this gives me a 401 unauthorized http error as I am not passing the username and password to the clover http url.
The following is the format of the constructed url. - http://<host>:<port>/clover/simpleHttpApi/graph_run?sandbox=<sandboxname>&graphID=graph/Baseline.grf&verbose=FULL
Can anyone suggest how to pass user credentials to this url.
Thanks

Brett,
Thanks for the response.
The idea is to run the baseline graph using the simple http api and get the run id of the job. Then I plan to call
this url - http://<host>:<port>/clover/simpleHttpApi/graph_status?runID=1310924&returnType=STATUS_TEXT&waitForStatus=FINISHED_OK by passing the obtained run ID of the previous job dynamically to this url. This status has to be read and printed on the screen. Now all this is easy to write using java and executing the java class using the JAVA EXECUTE component of Integrator ETL 3.1. My only problem is how do I pass the user credentials.
Thanks

How easy to sniff a public FTP/HTTP username and password?

Similar Messages

Maybe you are looking for