The worst-case leak
If a website asks you to log in over plain HTTP, your username and password are sent as ordinary text in the packet — usually in a POST body that looks like username=...&password=.... In a capture, that is a disaster you can read at a glance:
tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | tr -d '\r' | grep -E 'password='In the terminal
student@vulntech:~$ tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | tr -d '\r' | grep -E 'password=' username=admin&password=SpringTime2026
There it is: the password, in plain sight. This is the single most convincing demo of why plain HTTP must never be used for anything private.
Tip: When you find a credential in a capture, treat that password as burned — it must be changed, because it has been exposed on the wire.