> Open Wireshark.
> Select an interface and start capturing in promiscuous mode.
> To capture credentials from POP apply this filter:
pop.request.command == "USER" || pop.request.command == "PASS" |
> To capture credentials from IMAP apply this filter:
imap.request contains "login" |
> To capture credentials from SMTP apply this filter:
smtp.req.command == "AUTH" |