Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I have a proxy setup using squid on port 3128.
I also have ettercap setup.

My main goal is to change data as it flows through my proxy.

Basically, you open up www.something.com using my proxy, it displays "lala", and I want to alter "lala" using ettercap, into "lala2" for example.

Any commandline tips to achieve this ? This isn't a MITM ARP procedure from what I can tell.

share|improve this question
    
Still haven't found any reliable answer. The redirect_program actually refers to URLs and not data that passes through the proxy. –  Adrian A. Feb 3 '11 at 7:36
add comment

2 Answers

In squid.conf, use the redirect_program configuration variable to point at a program/script. In that script, you can mess with the data being passed through however you want. For a fun example, see Upside-Down-Ternet.

share|improve this answer
    
Considering I don't have that much knowledge, I would really need something directly available with ettercap. I just want to replace data. I got it working, I see the filters are running, but the data ( even though it shows as being replaced ), it's not working –  Adrian A. Jan 7 '11 at 20:06
add comment

What you really need is a proxy that will do the filtering at the application layer. There are modules for Squid that offer this, though a quick search is not showing any that don't require recompiling Squid. Alternatively, you could chain your Squid proxy through a proxy that offers the features you want. It could be as simple as a Perl script using HTTP::Proxy, or another language and library of your choice.

Ettercap really isn't the tool for this, though it could probably be made to work. You'll probably have to muck around with the kernel routing tables to get it to work. Try sniffing your traffic in the current configuration: you may find that Ettercap is retransmitting modified frames without dropping the original ones. Also, make sure you have the latest version of Ettercap. It was recently re-released with lots of bug fixes, and I know at least a few had to do with packet filtering. Latest version is 0.7.4.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.