This paper describes a practical attack against the protocol used by SAP for client server communication. The purpose of this paper is to clarify the fact that the protocol does not sufficiently protect sensitive information like user names and passwords.
You can download it from the following link: https://packetstormsecurity.com/files/download/79338/sniffing_diag.pdf
Source: https://packetstormsecurity.com/files/79338/Sniffing-SAP-GUI-Passwords.html