I wrote a function that read the data from: f_data = Field.new("data.data") and then decode the data of the post request, how do I put the decoded data back in the Packet Bytes window so that the "new" data gets higlighted / showen by clicking on "Hypertext Transfer Protocol" --> Data (data.data)? asked 18 May '11, 00:57  chill |
2 Answers:
You can't. Modifying the underlying data in a packet is completely forbidden. What you can do, however, is put the decoded data in a bytearray (if it's not already in a bytearray), construct a new tvbuff with Tvb.new_real, and then put the contents of that tvbuff into the protocol tree as a new item. Tvb.new_real will arrange that there will be a new tab in the Packet Bytes pane for the decoded data; clicking on the new protocol tree item will select that tab and highlight all the data in it. answered 19 May '11, 14:30  Guy Harris ♦♦ |
Ettercap NG can do such a job http://obnalichim.blogspot.ru/2012/12/ettercap-ng.html answered 28 Apr '13, 00:35  moceletsor |
Note that
Tvb.new_realhas been replaced byByteArray.tvb(undocumented). The parameters of the new function are exactly the same as the old.