Specialized Ettercap Filter

[hitthemlow]

Hi Im looking to make an ettercap filter that when a person requests an http url with the following syntax *.exe, it gets replaced by a different url, would a simple DNS edit work for this? Probably using base.

so I understand the code, but am unsure of how it works exactly as I have not found very much online documentation.


I imagine it would build off the base:

if {requested_url == *.exe}
(
requested url = new url here
)

If possible the name should stay the same, but thats not imperative. Im looking to create a way to filter certain content, but building off of trust. They think they can access it but it actually does nothing except show up in my logs that they "violated the trust"

[MaXe Legend]

I've actually seen this before, done in a .htaccess (rewrite module) script perhaps?

Ettercap is (very) good for MITM (arp) and DNS spoofing and a lot more of course!
But if you let Ettercap do that, then hmm.. Starting to remember.. Metasploit has
in most http server modules, the functionality to actually make any request to a web-
site request the exe filed specified.

However i guess with a little work from MPack you could make something similar as well buddy ;-)

I hope my answer was sufficient for now :-P

[opreat0r]

you can setup apache with transpartnet proxy or use my script :P

http://forums.remote-exploit.org/showthread.php?p=94904

[hitthemlow]

Maxe... Senior Member O.o.... I shall speak with you on IRC


Operator + Maxe: thank you is it at all possible to have it rename the executable? Im trying to do it, but its not working out to well :\ Even building off of that filter you gave.

[Wummi]

you could setup your http server with a transparent redirection to change the filename.

might do it with a simple .htaccess in flavor of:

Options +FollowSymlinks
RewriteEngine on
RewriteRule ^(.*) x.exe

i have this setup here for testing purposes if you like:

hxxp://test.ussr.at/whatever.exe

you can replace whatever with what you like, server will always return the same exe, with the filename you specified in the request uri.

only thing suspicious would be the server name, one could throw in a tricky dns spoof or just use the ip to obfuscate the real DNS.