Prove encryption hides content but not the conversation

short · 50 min · Objective 2.3

Task

Capture the same exchange in cleartext and encrypted forms on your own lab, and prove for yourself what TLS does and does not hide — because "we use TLS, so we're fine" is a claim you will have to answer precisely for a client.

Steps

  1. On the lab network you own, stand up a service reachable both in cleartext and over TLS, with an account you created.
  2. Capture traffic while you log in over the cleartext version. Save to /tmp/clear.pcap.
  3. Find the credentials in that capture — following the stream — and note how little work it took.
  4. Repeat over the TLS version, saving /tmp/tls.pcap, and confirm the credentials are not readable.
  5. Now list what the TLS capture still reveals: the endpoints, the timing and volume, the server name from the handshake, and the certificate details.
  6. Write the one-sentence answer to a client asking whether TLS "fixes" the exposure.

Verify

tshark -r /tmp/clear.pcap -Y "ftp.request.command == USER || http.authorization" 2>/dev/null | wc -l
tshark -r /tmp/tls.pcap -Y "tls.handshake.extensions_server_name" -T fields -e tls.handshake.extensions_server_name 2>/dev/null | sort -u | wc -l
tshark -r /tmp/tls.pcap -Y "http.authorization" 2>/dev/null | wc -l

The first count must be non-zero: the cleartext capture exposed the credential. The second must be non-zero: even over TLS, the server name from the handshake is visible, which is part of the metadata encryption does not hide. The third must be zero: the credential is not readable in the TLS capture. Together they are the precise answer — content protected, conversation not.

Notes

Capture filters decide what is recorded and lose what they exclude; display filters only change the view — so capture broadly and filter narrowly. Shodan, covered in the lesson, is a passive and historical view: cite it with its scan date and corroborate before asserting present exposure, and remember that reading a Shodan record is passive while connecting to the address in it is not. Everything here ran on a network you own.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.