arsenal/bettercap

bettercap

network & wifi MITM framework · GPL-3.0

The swiss-army knife for active network attacks: ARP spoofing, traffic sniffing, wifi handshake capture, and BLE and HID work, all from one interactive console.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01One console, many modules

Where aircrack-ng is a set of separate programs, bettercap is a single interactive shell with modules you switch on and off. You pick an interface, start the modules you need, and watch events scroll past. It covers wired Ethernet, wifi, Bluetooth Low Energy, and wireless HID, which makes it the active counterpart to Kismet's passive listening.

» net modules: discover hosts, ARP-spoof, and sniff traffic on a LAN.

» wifi modules: scan, capture handshakes and PMKIDs, and deauth.

» ble and hid modules: enumerate Bluetooth LE devices and wireless keyboards.

» A built-in web UI and a caplet system for scripting whole workflows.

02Install and start a session

bettercap is a single Go binary, in most repos as a package. Start it against the interface you want to work on; it drops you into its own prompt. For wifi work, point it at your wireless card and it manages monitor mode itself.

$ sudo emerge net-wireless/bettercap # Gentoo

$ sudo apt install bettercap # Debian / Ubuntu / Kali

$ # Fedora / others: go install, or download from bettercap.org

» The prompt shows your network and your own address. Type help to list modules and their state, and help <module> for a module's options. Everything from here is commands typed at that prompt.

↑ contents

03Discover what is on the LAN

Before touching anything, map the network. net.probe sends probes to wake hosts, net.recon watches the ARP table, and net.show prints the result. This is the same first move as any engagement: know what is there before you act.

$ net.probe on

$ net.show

» Now you know the gateway and the hosts. For a MITM test you will sit between one host and the gateway and watch the traffic that should have gone straight past you.

04ARP spoof and sniff your own test host

ARP spoofing tells a target that you are the gateway and tells the gateway that you are the target, so their traffic flows through you. Turn on sniffing at the same time and you see it. On your own network this demonstrates exactly why plain HTTP and unencrypted protocols are dangerous.

$ set arp.spoof.targets 192.168.1.20

$ set net.sniff.verbose false

$ arp.spoof on

$ net.sniff on

» There it is: a plaintext login captured off your own wire. The lesson writes itself. Anything not encrypted is readable by whoever controls the path. Turn the modules off with arp.spoof off and net.sniff off when done, so the ARP tables heal.

↑ contents

05Scan wifi and capture a handshake

Restart bettercap against your wireless card and the wifi module takes over. wifi.recon scans, wifi.show lists what it found, and bettercap captures handshakes and PMKIDs automatically as it sees them, writing a pcap you can crack later.

$ sudo bettercap -iface wlan0

$ set wifi.handshakes.file /tmp/handshakes.pcap

$ wifi.recon on

$ wifi.show

» To force a capture from a connected client, deauth it briefly, just as with aircrack-ng. bettercap's deauth targets one BSSID at a time.

$ wifi.deauth AA:BB:CC:11:22:33

» That pcap goes straight to hcxtools and hashcat for the offline test, the same crack path as the aircrack-ng guide.

06Caplets: scripting a workflow

Typing the same sequence every time is tedious, so bettercap reads caplets: text files of commands it runs in order. You can write your own or use the bundled ones. This is how you turn a repeatable test into one command.

$ caplets.show

$ sudo bettercap -iface wlan0 -caplet /usr/share/bettercap/caplets/wifi-recon.cap

» A caplet for your own site, pinned to your BSSIDs, makes a periodic self-test a single line. Keep the scope tight so a stray run never reaches beyond what you own.

07Hardening from what you saw

bettercap is loud on purpose, and that noise is the lesson for defence.

» Encrypt everything on the LAN: the sniffed plaintext login is the whole argument for TLS and SSH everywhere, even internally.

» Enable dynamic ARP inspection and DHCP snooping on managed switches to stop ARP spoofing at the network layer.

» Turn on 802.11w on your wifi so the deauth step fails; WPA3 enforces it.

» Run Kismet alongside your own bettercap tests and confirm the deauth and spoof raise alerts.

» Segment sensitive hosts so that even a successful MITM sees as little as possible.

If a five-minute bettercap session on your own network hands you credentials in the clear, that is the finding. Fix the plaintext, re-test, and confirm the capture comes up empty.

↑ contents