Which technique allows someone to obtain a password while it is in transit?

Packet sniffing, also known as network sniffing or eavesdropping, is a technique that involves capturing, decoding, and analyzing data packets as they travel across a network. An attacker can use a packet sniffer tool to monitor network traffic. If a password is transmitted in cleartext (i.e., without encryption) over protocols like HTTP, FTP, or Telnet, the sniffer can capture the packet containing the password, allowing the attacker to read it directly. This method specifically targets data while it is in transit between two points on a network.

B. Buffer overflow: This is a software vulnerability exploit that targets an application's memory management. It does not involve intercepting data in transit.

C. Phishing: This is a social engineering attack where an attacker deceives a user into voluntarily disclosing their password, not intercepting it during transmission.

D. Black hat: This term describes a malicious hacker or an actor with malicious intent. It is a classification of a person, not a technical method.

1. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Section 8.1.2, "A Packet Sniffer," the authors state, "A passive receiver that records a copy of every packet that flies by is called a packet sniffer... Sniffers can be used for nefarious purposes, such as discovering an organization’s passwords."

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 21, "Network Attacks," the concept of eavesdropping (sniffing) is described as a passive attack where an attacker monitors transmissions for message content, including passwords sent in the clear.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 10: Network Security. The lecture notes describe how an attacker on a local network can use a sniffer to "see all traffic on the wire," which includes capturing unencrypted passwords. (Available at: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/mit6858f14lec10/)

4. Al-ani, Z. K. M. (2011). Network security: A survey. In 2011 International Conference on Information and Communication Technology Research (ICTRC) (pp. 1-6). IEEE. Section III, "Types of Attacks," categorizes sniffing as a passive attack used to "steal information such as passwords and other sensitive information." (DOI: 10.1109/ICTRC.2011.5967626)