Ettercap/ettercap — pull request #217 by AntonioCollarino (2013-04-30 21:08:07+00:00)
Title: Feature for credential in HTTP POST packet and issue #214

Hi everyone,
I added a new feature for get the right credential from HTTP POST packet.
Now if at least one words (user/pass) of etter.fields file is found in the http post packet, ettercap prints on the screen the credentials of the victim(s). Thanks to the content that is also printed on the screen, it's possible to avoid the "false positive".
1) user word (among etter.fields) is present in the http post packet, but not the password (among etter.fields) or viceversa.
2) user word (among etter.fields) or password (among etter.fields) isn't correct understood by ettercap.
3) some other combination of n1 and n2.
What I mean is that now if ettercap doesn't print the right sensible user data, the attacker can simply read the content and understand it.

For example this is the output (when both are correct understood):
HTTP: IP 212.66.107.153 PORT 80 --> USERNAME: alex PASSWORD: dragon
URL: http://www.juventusmember.com/login?
CONTENT: user_name=alex&passwd=dragon&login=login&login201=

For example this is the output (if the word user_name is not in "user" etter.fields file):
HTTP: IP 212.66.107.153 PORT 80 --> USERNAME: login PASSWORD: dragon
URL: http://www.juventusmember.com/login?
CONTENT: user_name=alex&passwd=dragon&login=login&login201=

p.s.1 I also added the right copyright (Ettercap Dev. Team) in more files where there were only alor and naga.

p.s.2 fixed a part of the problem of the issue #214, now ettercap is not closed if the sslstrip plugin cannot start.

Antonio Collarino