I know a packet sniffer is really powerful. It can sniff out password and images and so on. Can it sniff URL too? Meaning, if I put my authentication in URL instead of a cookie, will sniffer be able to obtain the authenticated session ID from the URL? What about hidden value in form based authentication? Are they all open to sniffer attacks?
Bascially there is no security in public network (non-https non-ssh)? Not sure how https can be safe as well. I mean, the first handshake attempt will already be sniffed before connection is established. Not sure how safe that would be.
Thank you.