🦈 Wireshark Packet Analysis Lab

PRACIVO LAB — INTENTIONALLY VULNERABLE
⚠️ Pracivo Security Lab — Download PCAP files and open them in Wireshark. Each file contains hidden credentials or sensitive data to find.

FTP Credential Extraction

Extracting FTP Credentials from Packet Capture

# FTP sends credentials in cleartext on port 21
# Apply Wireshark filter:
ftp

# Look for packets containing:
# USER ram
# PASS pracivo

# Or filter specifically:
ftp.request.command == "USER" or ftp.request.command == "PASS"

# Follow TCP stream to see full session:
# Right click packet → Follow → TCP Stream

# Why FTP is dangerous:
# - No encryption
# - Credentials visible to anyone on the network
# - Use SFTP (port 22) or FTPS instead