Is http:// and :80 in the payload or headers?
For example, you'd normally see this in Location headers (redirects) and in payload data referencing document objects. But if in payload, it's probably better to avoid regex and just do multiple string maps.
when HTTP_RESPONSE_DATA {
set payload [string map [list "\}\}\}\}" "\}\}"] [HTTP::payload]]
set payload [string map [list "http://" "https://"] [HTTP::payload]]
set payload [string map [list ":80" ""] [HTTP::payload]]
HTTP::payload replace 0 $clen $payload $fixeddata1
HTTP::release
}
What you're doing is grabbing the existing payload into a variable, making changes to that variable, and then completely replacing the HTTP::payload with the contents of that variable.