Script Problem

[enc0de]

Hello every one now everytime I run this in etterfilter I get an error..

if(ip.proto==TCP && tcp.dst==80){
    if(search(DATA.data,"Accept-Encoding")){ 
      replace("Accept-Encoding", "Accept-Rubbish!");

       msg("zapped Accept-Encoding!\n");
       }
     }


if(ip.proto==TCP && tcp.src==80){
    replace("img src","img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\"");

    replace("IMG SRC","img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\"");


    msg("Filter Ran.\n");
}

THIS IS THE ERROR

root@bt:~/enc0de# etterfilter ron.filter -o ron.ef

etterfilter NG-0.7.3 copyright 2001-2004 ALoR & NaGA


 12 protocol tables loaded:
        DECODED DATA udp tcp gre icmp ip arp wifi fddi tr eth

 11 constants loaded:
        VRRP OSPF GRE UDP TCP ICMP6 ICMP PPTP PPPoE IP ARP

 Parsing source file 'ron.filter'
[ron.filter:2]: Function "if" not recognized

Can someone point me in the right direction here.

Thanks for you time and input.

[armedpilot]

Put a space after the if's. Functions don't have spaces. The if's do.

Hello every one now everytime I run this in etterfilter I get an error..

if(ip.proto==TCP && tcp.dst==80){
    if(search(DATA.data,"Accept-Encoding")){ 

if(ip.proto==TCP && tcp.src==80){

Thanks for you time and input.

[pieface]

It should be:

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!");
          # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!\n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("img src=", "img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\" ");
   replace("IMG SRC=", "img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\" ");
   msg("Filter Ran.\n");

try compile as you have been,also

etterfilter ron.filter -o ron.ef
chmod 755 ron.ef

Make sure you execute ettercap from the same directory as ron.ef

[thorin]

I'm not sure why your if is failing but your replacement is going to fail.

Assume pages contain "img src=blef.gif" after your replacement I believe it will contain "img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\blef.gif". Your if statement might be failing because you have an odd number of " (quote symbols) in your replace statement (looks like you have 5 when you only need 4).

[hhmatt]

I'm not sure why your if is failing but your replacement is going to fail.

Assume pages contain "img src=blef.gif" after your replacement I believe it will contain "img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\blef.gif". Your if statement might be failing because you have an odd number of " (quote symbols) in your replace statement (looks like you have 5 when you only need 4).

replace("img src","img src=\"http://www.hellokittypink.com/wp-content/uploads/2008/01/hello-kitty-contacts.jpg\"");

I count 6.

@OP
It is indeed the space between your if statement. Check this out it may be of help to you.

http://www.irongeek.com/i.php?page=s...ettercapfilter

[enc0de]

Thanks for all the help and support.