I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. Once a second it just sends a random letter to the server. The server echos it back. Basically in dummy_init I added one line of code

 hook_add(HOOK_HANDLED, &processpacket);

then the function is

static void processpacket(struct packet_object *po)
 if(po->DATA.data[0] == 71)
    USER_MSG("Changing from G to L");
    po->DATA.data[0] = 77;

Basically this has no effect. I have also tried setting all the different flags so that it knows its modified with no effect. I have also tried running it in bridge mode with two separate vms but I can't get the bridge mode to work.Even when I have

 if (po->flags & PO_FROMIFACE)
       USER_MSG("From Interface\n");
    else if (po->flags & PO_FROMBRIDGE)
       USER_MSG("From Bridge\n");

The send functions literally seem to do nothing in bridge mode or normal mode). I have the latest from github compiled. Any help would be greatly appreciated. It appears that sslstrip plugin only uses ettercap for one end, then just creates a separate ssl session independently and manages it through another thread? Is that correct , does ettercap not have the ability to intercept and modify packets? There are send functions in sslstrip but I can't figure out why they don't do anything in my plugin. Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.