I'm using Ettercap as MITM for testing on sniffing password but I'm not getting some POST request data containing "usuario" (user in spanish) and "clave" (password in spanish).

I'd like to know if there's some editing file in order to add those fields into the sniffing engine.

2 Answers 2


Just add "usuario" to "[USER]" and "clave" to "[PASS]" in the etter.fields file. On my system it is located at /usr/share/ettercap/etter.fields.

Citation from the file:

This file contains the form fields recognized as user or password by the HTTP dissector. You can add your own fields in the right section


I'm away from my laptop right now but I remember that the ettercap configuration file is called etter.conf. I frequently use ettercap with arpspoof as a MITM attack and it always outputs any cleartext unencrypted HTTP POSTs. I would make sure that the login page you are trying to sniff isn't HTTPS or if it is unencrypted, that it doesn't post to HTTPS.

Edit: I only glanced over the question and didn't notice the spanish comment. Yes, it's likely ettercap is skipping it because of the form name. Follow JayfromA's advice.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .