GO KALI FREE

Bettercap

Sniffing & Spoofing

Advancedhigh risk

Bettercap is a powerful, flexible network attack and monitoring framework. It is the complete modular successor to ettercap, offering wide-ranging capabilities for WiFi, Bluetooth, and IP network security auditing.

Installation

sudo apt install bettercap

Basic Syntax

sudo bettercap

Quick Facts

Full Name
Bettercap
License
GPL v3
Written In
Go
Platforms
Linux, macOS, Android, BSD
Category
MITM Framework
Attack Types
MITM, WiFi, BLE, HID, Ethernet
First Release
2016
Author
Simone Margaritelli (evilsocket)

Tool Overview

Bettercap is the most comprehensive network attack and monitoring framework available for Kali Linux. Developed by Simone Margaritelli, it replaces outdated tools like Ettercap with a modern, modular architecture that supports Ethernet MITM, WiFi audits, Bluetooth/BLE attacks, and HID device emulation.

The framework features a powerful scripting engine (Lua), a REST API for integration, and a web UI for visual monitoring. Its modular design allows users to enable only the features they need, making it efficient for both simple ARP spoofing and complex multi-vector attacks.

Bettercap has become the standard tool for modern MITM attacks, WiFi security testing, and network monitoring. Its active development community ensures support for the latest protocols and attack techniques.

Common Commands

sudo bettercapLaunch interactive - Start bettercap interactive console session
net.probe onDiscover hosts - Dynamically search local network for active systems
net.showShow discovered hosts - Print a formatted grid of all detected network clients
set arp.spoof.targets 192.168.1.100Set ARP target - Configure the exact target client IP addresses for interception
set arp.spoof.fullduplex trueFull duplex - Enable bidirectional routing spoofing between client and gateway
arp.spoof onStart ARP spoof - Begin localized Man-in-the-Middle routing redirection
net.sniff onStart sniffer - Initialize real-time local packet capturing and parsing
wifi.recon onWiFi recon - Broadcast passive scanning to map nearby wireless access points
ble.recon onBluetooth recon - Start discovering nearby low energy Bluetooth peripherals
any.proxy onEnable proxy - Spin up localized internal application layer transparent proxies
events.stream onStream logs - Display running network events and caught notifications in real time
help <module>Module help - Output explicit parameters and operational flags for a specified component
set dns.spoof.domains target.com set dns.spoof.address 10.0.0.1; dns.spoof onDNS spoof - Redirect a domain to an attacker-controlled address
set http.proxy.sslstrip true; http.proxy onSSL strip - Downgrade HTTPS to HTTP through the HTTP proxy
net.sniff.filter "tcp port 80"Sniff filter - Apply a BPF filter to the packet sniffer

Step-by-Step Guide

  1. 1Open the primary interactive console interface
  2. 2Activate the probe module to identify surrounding devices
  3. 3Display the results to select your targets
  4. 4Define the parameters for your routing manipulation
  5. 5Engage the redirection mechanism
  6. 6Turn on the sniffer to begin collecting data from the redirected traffic

Warnings

Use Cases

ARP Spoofing

Redirect traffic between hosts through your system for interception and modification.

DNS Spoofing

Redirect DNS queries to malicious servers for credential harvesting or phishing.

HTTPS Interception

Perform SSL stripping and HSTS bypass attacks to capture encrypted traffic.

WiFi Deauthentication

Disconnect clients from access points to capture handshakes or force reconnection.

BLE Scanning

Discover and interact with Bluetooth Low Energy devices for IoT security testing.

Credential Sniffing

Capture HTTP POST data, FTP credentials, and other unencrypted authentication traffic.

Related Tools

arpspoof

Sniffing & Spoofing

Simple ARP spoofing tool from the dsniff suite for basic traffic redirection.

Ettercap

Sniffing & Spoofing

Classic MITM framework with ARP poisoning, DNS spoofing, and content filtering.

mitmproxy

Sniffing & Spoofing

Interactive SSL/TLS-capable intercepting HTTP proxy for traffic analysis.

Wireshark

Sniffing & Spoofing

GUI-based network protocol analyzer with deep packet inspection capabilities.

Metasploit

Exploitation

Exploitation framework with post-exploitation modules for compromised systems.

Frequently Asked Questions

What is Bettercap used for?

Bettercap is a powerful network attack and monitoring framework used for man-in-the-middle attacks, ARP spoofing, DNS poisoning, WiFi auditing, Bluetooth/BLE attacks, HTTP/HTTPS interception, and network reconnaissance.

Is Bettercap better than Ettercap?

Yes, Bettercap is the modern successor to Ettercap with more features, better performance, active development, and support for WiFi, Bluetooth, and BLE attacks in addition to traditional MITM techniques.

Does Bettercap have a GUI?

Yes, Bettercap features a modern web UI accessible from any browser, in addition to its interactive CLI and REST API. The web UI provides visual network maps and real-time monitoring.

Can Bettercap decrypt HTTPS?

Bettercap can perform SSL stripping and HSTS bypass attacks to downgrade HTTPS to HTTP. It cannot decrypt properly configured TLS without the private key.

What is ARP spoofing in Bettercap?

ARP spoofing in Bettercap uses the arp.spoof module to forge ARP replies, associating your MAC address with the gateway IP so target traffic flows through your system for interception.

How does Bettercap perform MITM attacks?

Bettercap positions itself between two hosts by poisoning ARP caches, enabling traffic interception. Modules like net.sniff capture packets, and proxies modify traffic in transit.

Can Bettercap sniff packets like Wireshark?

Bettercap's net.sniff module captures and parses packets in real-time, showing HTTP requests, credentials, and network flows. For deep protocol dissection, exported PCAPs can be analyzed in Wireshark.

How does Bettercap probe the network?

The net.probe module sends ARP or ICMP requests to discover active hosts on the local network, displaying IP, MAC, vendor, and hostname information in a live-updated table.

What are Bettercap caplet scripts?

Caplets are Bettercap's automation scripts written in a simple command syntax. They chain multiple modules together for repeatable attack workflows, similar to Metasploit resource scripts.

Can Bettercap perform WiFi attacks?

Yes, Bettercap's wifi.recon module scans nearby access points, captures handshakes, and can launch deauthentication attacks. An external WiFi adapter supporting monitor mode is required.

How do I start Bettercap in interactive mode?

Run sudo bettercap -I eth0 to start the interactive console. The -I flag specifies the network interface. Once in the console, you can enable modules individually with their respective commands.

Can Bettercap capture HTTPS credentials?

Bettercap can perform SSL stripping to downgrade HTTPS to HTTP, capturing credentials in plaintext. For encrypted HTTPS traffic, use bettercap's HTTPS proxy with a custom SSL certificate for targeted interception.

How do I use Bettercap caplets?

Caplets are automation scripts loaded with -caplet: sudo bettercap -caplet http-req-dump.cap. They chain multiple modules together for repeatable attack workflows. Create custom caplets for your specific testing scenarios.

Can Bettercap enumerate network hosts?

Yes, use net.probe on to discover hosts on the local network. Bettercap sends ARP and ICMP probes to identify active hosts, displaying IP, MAC, vendor information, and hostnames in a live table.

How do I access the Bettercap web UI?

Enable the web UI with: set api.rest.username admin; set api.rest.password pass; api.rest on. Then open https://127.0.0.1:50000 in a browser. The web UI provides visual network maps and real-time monitoring.

Can Bettercap perform DNS spoofing?

Yes, enable dns.spoof module and set a custom DNS mapping: set dns.spoof.domains {target.com:attacker.com}; dns.spoof on. This redirects DNS queries for the target domain to your specified IP address.

How do I save captured traffic from Bettercap?

Use net.sniff.output /path/to/file.pcap to save captured packets to PCAP format for analysis in Wireshark. You can also use --raw to save raw packet data for custom analysis.

Can Bettercap target specific hosts only?

Yes, set a target IP range: set arp.spoof.targets 192.168.1.100. This limits the ARP spoofing attack to specific hosts rather than the entire subnet, reducing network noise and detection risk.

How do I stop Bettercap and restore ARP tables?

Type quit or press Ctrl+C to stop Bettercap. It automatically restores ARP tables to their original state. If interrupted abruptly, manually restore with: arp -s gateway_ip gateway_mac on each affected host.

Tags

#sniffing-spoofing#mitm#network-analysis

Output Explanation

Features a live, scrolling console that displays network topography changes, intercepted requests, and captured authentication materials.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.