No lock on the door
Web traffic comes in two kinds. HTTPS (port 443) is encrypted — in a capture you just see scrambled bytes. HTTP (port 80) is not encrypted at all. Every request travels as plain text, so anyone who can see the packets can read exactly what was asked for.
The -A flag tells tcpdump to print the readable text inside each packet. Point it at the web traffic and the request appears in plain English:
tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | grep -E 'GET|POST|Host:'In the terminal
student@vulntech:~$ tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | grep -E 'GET|POST|Host:' 08:10:02.000000 IP 10.10.10.5.50100 > 93.184.216.34.80: Flags [P.], seq 1:72, ack 0, win 1024, length 71: HTTP: GET /admin HTTP/1.1 .].."...P........P.......GET /admin HTTP/1.1 Host: portal.example.com 08:10:03.000000 IP 10.10.10.5.50100 > 93.184.216.34.80: Flags [P.], seq 1:158, ack 0, win 1024, length 157: HTTP: POST /login HTTP/1.1 .].."...P........P.......POST /login HTTP/1.1 Host: portal.example.com
You can see the GET line (which page) and the Host: header (which website). Nothing is hidden, because nothing is encrypted.
Tip: This is exactly why sites moved to HTTPS. On plain HTTP, the network — and anyone capturing it — sees everything.