Replicate the entire setup as in the previous lab. Fire up Wireshark. Interestingly, even the MITM-bridge shows up. This interface would allow us to peer into the bridge traffic, if we wanted to:

Start sniffing on the at0 interface so that we can monitor all traffic sent and received by the wireless client:

On the wireless client, open up any web page. In my case, the wireless access point is also connected to LAN and I will open it up by using the address http://192.168.0.1:

Sign in with your password and enter the management interface.

In Wireshark, we should be seeing a lot of activity:

Set a filter for http to see only the web traffic:

We can easily locate the HTTP post request that was used to send the password to the wireless access point:

Next is a magnified view of the preceding packet:

Expanding on the HTTP header, allows us to see that actually the password we entered in plain text was not sent as is; instead...