I am trying to intercept TCP traffic and alter the data in the packet using an ettercap filter.

I am man-in-the-middling communication and have set up the following filter for use with ettercap:

if (search(DATA.data, "\x32\x30\x00\x00\x00\x04")) {
   msg("Message intercepted\n");
   replace("\x32\x30\x00\x00\x00\x04", "\x32\x30\x00\x00\x00\x01");

When I send the test message, the mitm works, I get the debug "Message Intercepted" message popping up - meaning that it has found the very specific string in the data, but it is failing to replace the \x04 with \x01 at the end.

I am relatively new to ettercap filters so any help would be much appreciated!

EDIT: Some additional information - the MITM I am attempting involves sending a message to my host running ettercap, and I am using socat to forward this back to the original host. I am wondering if socat is forwarding the original unedited message even though ettercap is editing it correctly? Ettercap is able to drop packets entirely though, so I had thought the packet was getting intercepted by ettercap before it hit socat? I am not sure how else I could perform the packet forwarding without using socat as ettercap is not running on the same subnet as the target and so it fails to find hosts.

ADDITIONAL INFORMATION: I am trying to forward the packet within the filter - I have killed socat and am now using:

if (ip.src == '<IP>') {
   ip.dst = '<IP>';

I get the HIT message meaning that it is detecting the packet from the target, however, it is not successfuly changing the destination.

  • Did you ever figure this out? I can't seem to modify packets at all with ettercap. – noone392 Apr 17 '19 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.