Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: ettercap filters

  1. #1
    Member
    Join Date
    Jul 2007
    Posts
    145

    Default ettercap filters

    I tried searching here and google but no luck

    Is it possible to make a filter for ettercap that will redirect ALL http traffic to a single website?

    Or is anyone good at coding, cause I know nothing about it and it seemed too hard for me to learn



    Oh and another thing, is it possible to replace all youtube videos with a single vid of my choosing?

  2. #2
    Moderator theprez98's Avatar
    Join Date
    Jan 2010
    Location
    Maryland
    Posts
    2,533

    Default

    Quote Originally Posted by unlazyfree View Post
    I tried searching here and google but no luck

    Is it possible to make a filter for ettercap that will redirect ALL http traffic to a single website?

    Or is anyone good at coding, cause I know nothing about it and it seemed too hard for me to learn



    Oh and another thing, is it possible to replace all youtube videos with a single vid of my choosing?
    Google found your answer...the Ettercap forums.
    "\x74\x68\x65\x70\x72\x65\x7a\x39\x38";

  3. #3
    Member
    Join Date
    Jul 2007
    Posts
    145

    Default

    Well, like I said, I wasn't able to find examples of filters on google (searched ettercap forums, too). I was hoping for a thread where people post their scripts and what they do. The etter.filter.examples file wasn't any help either (at least to me, like I said I don't know much about programming in C or whatever language it is)

  4. #4
    Member
    Join Date
    Jul 2007
    Posts
    145

    Default

    You gotta trust me when I say I searched, I spent about a week looking around the ettercap forums, here, and google.

  5. #5
    Moderator theprez98's Avatar
    Join Date
    Jan 2010
    Location
    Maryland
    Posts
    2,533

    Default

    Quote Originally Posted by unlazyfree View Post
    You gotta trust me when I say I searched, I spent about a week looking around the ettercap forums, here, and google.
    I recommended the ettercap forums because, while you might not find a pre-made script, you're more likely to get a better answer there vice here since everyone there knows ettercap exclusively.
    "\x74\x68\x65\x70\x72\x65\x7a\x39\x38";

  6. #6
    Junior Member
    Join Date
    Jul 2006
    Posts
    88

    Default

    There is a video on http://www.irongeek.com/ about Ettercap filters, i hope that helps.

    PS: try Visual Basic, its a very easy to learn programming language for beginners.

  7. #7
    Member
    Join Date
    Jul 2007
    Posts
    145

    Default

    Quote Originally Posted by theprez98 View Post
    I recommended the ettercap forums because, while you might not find a pre-made script, you're more likely to get a better answer there vice here since everyone there knows ettercap exclusively.
    I tried, the forums pretty much dead. there hasn't been a single post in quite a while and its been taken over by bots

  8. #8
    Senior Member imported_spankdidly's Avatar
    Join Date
    Feb 2006
    Posts
    1,031

    Default

    Man, I asked this SAME question a few months back. I went to the Ettercap forums, not sure what's going on there, but it was pretty worthless. I found a small Tutorial that gave a little info and it actually worked, but not real well. I can't find the page now, but I ran across this

    if (ip.proto == TCP && tcp.src == 80) {
    replace("<HEAD>", "<HEAD><META http-equiv=\"refresh\" content=\"0;URL=http://tazforum.thetazzone.com/index.php\">");
    replace("<head>", "<head><META http-equiv=\"refresh\" content=\"0;URL=http://tazforum.thetazzone.com/index.php\">");
    msg("redirect success\n");
    }

    From h**p://tazforum.thetazzone.com/viewtopic.php?t=6517

    Seems IIIInteresting! I know I saved the other Tutorial, probably on my backtrack laptop. I will try and find that tomorrow. This looks like it (the filter) just with a different URL redirection. The other one was to zomba or zoomba or zooma or something. Good luck!

    (I was thinking redirect all Lan traffic to a metasploit ANI or WMV exploit, and then remote shell it. Every time I get around to trying it, something comes up. I even threw together a few scripts to make it all quicker, but there's always work to do somewhere).

  9. #9
    Member
    Join Date
    Jul 2007
    Posts
    145

    Default

    Quote Originally Posted by spankdidly View Post
    Man, I asked this SAME question a few months back. I went to the Ettercap forums, not sure what's going on there, but it was pretty worthless. I found a small Tutorial that gave a little info and it actually worked, but not real well. I can't find the page now, but I ran across this

    if (ip.proto == TCP && tcp.src == 80) {
    replace("<HEAD>", "<HEAD><META http-equiv=\"refresh\" content=\"0;URL=http://tazforum.thetazzone.com/index.php\">");
    replace("<head>", "<head><META http-equiv=\"refresh\" content=\"0;URL=http://tazforum.thetazzone.com/index.php\">");
    msg("redirect success\n");
    }

    From h**p://tazforum.thetazzone.com/viewtopic.php?t=6517

    Seems IIIInteresting! I know I saved the other Tutorial, probably on my backtrack laptop. I will try and find that tomorrow. This looks like it (the filter) just with a different URL redirection. The other one was to zomba or zoomba or zooma or something. Good luck!

    (I was thinking redirect all Lan traffic to a metasploit ANI or WMV exploit, and then remote shell it. Every time I get around to trying it, something comes up. I even threw together a few scripts to make it all quicker, but there's always work to do somewhere).
    awesome I'll check this out. Do you know if it's possible to filter youtube vids to one specific one? I sorta had an idea, the script for the picture replace, maybe just put in the file type of the youtube vid, then a link to the other vid (they give the links to the videos on youtube)

  10. #10
    Senior Member imported_spankdidly's Avatar
    Join Date
    Feb 2006
    Posts
    1,031

    Default

    No idea, I tried it with the previous script that I had found (can't find right now), but that didn't work too well. It would only redirect on certain pages it seems. Or it would say that the filter ran, but on the test laptop, the page was not redirected. I would REALLY like to find a filter that redirects EVERY page to a desired site. Kinda like a nocatsplash page (I think, ddwrt firmware for linksys router?). If I could script, I could come up with something, but I can't, so I wont lol. I'm not a l33t h4x0r, I just find anything wireless veddy interesting, that's how I found backtrack. From there, the monster grew. I tried ettercap at a hotel I was staying at, LOL, that's all I can say. Most are filtered or have a protection against that now. Last place, it had open wifi, BUT, I was too far away from the lobby to have a constant connection. (Sucked!). Anyway, if you find a script or something that works, PLEASE let me know.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •