\documentclass{article}
\usepackage{graphicx}
\usepackage{nopageno}
\usepackage{msc}

\begin{document}

\drawframe{no}
\setmscvalues{large}
\setlength{\instdist}{5cm}
\setlength{\instwidth}{4cm}
\setlength{\levelheight}{0.6cm}
\setlength{\actionwidth}{4cm}

\begin{msc}{credentials\_server}

\declinst{alice}{Alice}{web browser}
\declinst{yuri}{yuri.com}{vulnerable web server}
\declinst{trudy}{Trudy}{}
\declinst{george}{george.com}{web server}

\nextlevel[2]
\mess{\parbox[b]{4cm}{POST /login\\user=alice\&pass=foo}}{alice}{yuri}
\nextlevel[1]
\mess{\parbox[b]{4cm}{heartbeat(65535)}}{trudy}{yuri}
\nextlevel[2]
\mess{\parbox[b]{4cm}{response(65535)\\...user=alice\&pass=foo...}}{yuri}{trudy}
\nextlevel
\action{Obtains credentials}{trudy}
\nextlevel[3]
\mess{\parbox[b]{4cm}{POST /login\\user=alice\&pass=foo}}{trudy}{yuri}
\nextlevel
\mess{\parbox[b]{4cm}{POST /auth\\name=alice\&pwd=foo}}{trudy}{george}

\end{msc}

\end{document}