Check Loopback Traffic for Credentials
privesclinuxchecklist
Summary
Internal services often pass credentials in cleartext over loopback.
Walkthrough
Sniff loopback traffic to capture credentials from local-only services.
Commands
bash
sudo tcpdump -i lo -A
bash
sudo tcpdump -i lo -A | grep -i pass