It found nothing. Does that mean there are no credentials?

It means there are none in the shapes it knows. A custom protocol, a login inside a TLS session, or a challenge that base64s the body one extra time will all come back empty. Follow the longest TCP stream and read it - the scan is a shortcut, not a substitute.

All tools

NetworkRuns locallyNo account

Find plaintext credentials in a packet capture

Scan a capture for passwords sent in the clear - HTTP Basic auth, login forms, FTP, Telnet, POP3, IMAP and SMTP.

Open in ctfpal

A surprising number of protocols still in use send the password as text. The scan here looks for the shapes they take, and a hit usually ends the challenge - which is the point of the exercise: these protocols were designed before anyone assumed the network was hostile, and plenty of them are still deployed.

Protocol	What is in the clear	Where
HTTP Basic	`Authorization: Basic <base64 of user:pass>`	Request header
HTTP forms	`username=...&password=...`	POST body
FTP	`USER` and `PASS` commands	Control connection, port 21
Telnet	The password, typed one keystroke per packet	Port 23
POP3 / IMAP	`USER`/`PASS`, or `LOGIN user pass`	Ports 110 / 143
SMTP AUTH LOGIN	Base64 username and password, on separate lines	Port 25 / 587

Telnet is a special case

Telnet sends one character per packet and echoes it back, so the password does not appear as a string anywhere - it is spread across a dozen packets, interleaved with the echo. Reassembling the client-to-server direction of the stream is what turns it back into a word. That is the Follow TCP stream tab, filtered to one direction.

Common questions

It found nothing. Does that mean there are no credentials?: It means there are none in the shapes it knows. A custom protocol, a login inside a TLS session, or a challenge that base64s the body one extra time will all come back empty. Follow the longest TCP stream and read it - the scan is a shortcut, not a substitute.