This is a very noob question.I run the command dsniff -i eth0, and if I open a new terminal window and try my FTP-server, connect, and quit. dsniff returns the username and password.If I try the same thing with google.com, or other webservices dsniff does not report back the pass and username. Why is this? Are the sites I'm using immune to this type of attack? I've had no luck with any of the HTTP services. I'm using this is on my localhost,  for testing purposes, no arpspoofing necessary I reckon?
dsniff & httpsniffing
linux;security
By using dsniff, you have found out exactly why when developing sites with authentication, it is mandatory to use TLS to encrypt the communications.The encryption layer does obfuscates the inner workings of the HTTP protocol inside a protected tunnel, and dsniff is not able to get at the unencrypted stream in normal conditions.For more information, I will leave a link to TLS, and also to an answer of mine in security/stackexchangehttps://security.stackexchange.com/questions/110914/https-is-able-to-prevent-arp-poison-attack-in-lanfrom https://en.wikipedia.org/wiki/Transport_Layer_SecurityThe connection is private because symmetric cryptography is used to  encrypt the data transmitted. The keys for this symmetric encryption  are generated uniquely for each connection and are based on a secret  negotiated at the start of the session (see Handshake Protocol). The  server and client negotiate the details of which encryption algorithm  and cryptographic keys to use before the first byte of data is  transmitted (see Algorithm). The negotiation of a shared secret is  both secure (the negotiated secret is unavailable to eavesdroppers and  cannot be obtained, even by an attacker who places himself in the  middle of the connection) and reliable (no attacker can modify the  communications during the negotiation without being detected). The  identity of the communicating parties can be authenticated using  public key cryptography. This authentication can be made optional, but  is generally required for at least one of the parties (typically the  server). The connection is reliable because each message transmitted  includes a message integrity check using a message authentication code  to prevent undetected loss or alteration of the data during  transmission.