Using bettercap for Network Attacks

bettercap is the successor to the original ettercap, rebuilt from scratch in Go. It handles network attacks, WiFi auditing, Bluetooth Low Energy reconnaissance, and HTTP/HTTPS proxying - all from a single tool with a clean interactive interface and a web UI.

If nmap tells you what is on the network, bettercap lets you interact with it. ARP spoofing, DNS poisoning, traffic interception, evil twin access points, and BLE device scanning are all built in.

What Is bettercap?

bettercap is a network attack and monitoring framework. It operates as an interactive session where you load modules, configure parameters, and execute attacks. It supports Ethernet, WiFi (with monitor mode), and BLE interfaces.

Key capabilities:

• ARP spoofing for man-in-the-middle positioning
• DNS spoofing to redirect traffic
• WiFi deauthentication, handshake capture, and evil twin attacks
• BLE device discovery and enumeration
• HTTP/HTTPS proxy with scriptable request/response modification
• Packet sniffing with protocol-aware parsing
• Credential harvesting from unencrypted protocols

Installation

On Kali Linux, bettercap is in the repositories:

sudo apt install bettercap

On other Linux distributions, install from source or use the pre-built binaries from the GitHub releases page. You need libpcap and libnetfilter-queue development headers.

From source:

go install github.com/bettercap/bettercap@latest

Run it with root privileges (required for raw packet access):

sudo bettercap

To use a specific interface:

sudo bettercap -iface eth0
sudo bettercap -iface wlan0mon   # WiFi in monitor mode

Architecture and Interface

graph TD
    subgraph "bettercap Architecture"
        A["Interactive Session"] --> B["Module: net.probe"]
        A --> C["Module: arp.spoof"]
        A --> D["Module: dns.spoof"]
        A --> E["Module: wifi"]
        A --> F["Module: ble.recon"]
        A --> G["Module: http.proxy"]
        A --> H["Module: https.proxy"]
        A --> I["Module: net.sniff"]
    end
    subgraph "Interfaces"
        J["CLI Interactive"] --> A
        K["Web UI :80"] --> A
        L["REST API"] --> A
        M["Caplet Scripts"] --> A
    end
    subgraph "Network Interfaces"
        B --> N["Ethernet\neth0"]
        E --> O["WiFi Monitor\nwlan0mon"]
        F --> P["BLE\nhci0"]
    end

bettercap module architecture - all attack modules are controlled through a unified session interface

bettercap uses a module-based architecture. You start a session, enable modules, set their parameters, and they run concurrently. The interactive CLI uses a consistent pattern:

# List all modules
help

# Get help for a specific module
help arp.spoof

# Set a module parameter
set arp.spoof.targets 192.168.1.50

# Start a module
arp.spoof on

# Stop a module
arp.spoof off

Tab completion works throughout the interface. Typing net. and pressing tab shows all network-related commands.

Network Reconnaissance

Before attacking anything, map the network:

net.probe on    # Send probe packets to discover hosts
net.show        # Display discovered hosts

net.probe sends UDP packets to common ports across the subnet and listens for ARP responses. Within a few seconds, you will have a list of live hosts with their IP addresses, MAC addresses, and (often) hostnames and vendors.

The output includes OUI vendor identification from MAC addresses - so you can see which devices are Apple, Samsung, Intel, and so on. This is useful for identifying device types without any active fingerprinting.

You can also use net.recon for passive discovery (listen only, do not send probes):

net.recon on

ARP Spoofing

ARP spoofing (also called ARP poisoning) is the foundation of most network-level MITM attacks on switched Ethernet networks. It works by sending fake ARP replies that associate your MAC address with the gateway's IP address - causing target devices to send their traffic through you.

# Spoof a specific target
set arp.spoof.targets 192.168.1.50
arp.spoof on

# Spoof the entire subnet (excluding the gateway)
set arp.spoof.targets 192.168.1.0/24
arp.spoof on

By default, bettercap enables IP forwarding so traffic still reaches its destination - the target does not lose connectivity, and you sit invisibly in the middle. Without forwarding, the target loses internet access (which is sometimes the point, but usually not).

Full duplex spoofing (spoofing both the target and the gateway) gives you traffic in both directions:

set arp.spoof.fullduplex true
set arp.spoof.targets 192.168.1.50
arp.spoof on

Once positioned as MITM, enable the network sniffer to see traffic:

net.sniff on

bettercap automatically parses common protocols and will display credentials for HTTP, FTP, SMTP, POP3, IMAP, and other unencrypted protocols in real time.

DNS Spoofing

DNS spoofing redirects domain lookups to an IP you control. Combined with ARP spoofing, you can redirect a target's web traffic to a phishing page or capture portal.

# Redirect all domains to your machine
set dns.spoof.address 192.168.1.100
set dns.spoof.all true
dns.spoof on

# Redirect specific domains only
set dns.spoof.domains example.com, *.example.com
set dns.spoof.address 192.168.1.100
dns.spoof on

This works because ARP spoofing positions you as the gateway, so DNS queries from the target pass through you. bettercap intercepts them and responds with your chosen IP address before the real DNS server can reply.

Limitations: HTTPS with certificate pinning, HSTS, and DNS-over-HTTPS all defeat simple DNS spoofing. Modern browsers are increasingly resistant to these attacks, which is exactly why they exist.

WiFi Attacks

WiFi modules require a wireless adapter in monitor mode. Not all adapters support this - see our guide on USB WiFi adapters for monitor mode.

sudo bettercap -iface wlan0mon

WiFi reconnaissance:

wifi.recon on       # Start scanning for access points
wifi.show           # Display discovered APs and clients

This shows SSIDs, BSSIDs, channels, signal strength, encryption type, and connected clients.

Deauthentication (for handshake capture):

wifi.deauth aa:bb:cc:dd:ee:ff    # Deauth specific AP BSSID

Deauthentication forces clients to disconnect and reconnect, allowing you to capture the WPA handshake during reconnection. The captured handshake can then be cracked offline with hashcat.

Probe request harvesting:

When WiFi is enabled, bettercap automatically collects probe requests - the SSIDs that client devices are actively searching for. This reveals networks a device has previously connected to, which is useful for social engineering and evil twin attacks.

Evil twin access point:

bettercap can create a rogue access point that mimics a legitimate network. When combined with a captive portal, this can capture credentials. This is a complex attack that requires careful setup and a second wireless interface.

BLE Reconnaissance

bettercap includes BLE scanning capabilities that complement tools like the BLEShark Nano. It uses your host machine's Bluetooth adapter (usually hci0).

ble.recon on     # Start BLE scanning
ble.show         # Display discovered BLE devices

The output shows device addresses, names (if advertised), RSSI signal strength, and advertised service UUIDs. You can enumerate a specific device's GATT services:

ble.enum aa:bb:cc:dd:ee:ff

This lists all GATT services, characteristics, and their properties (read, write, notify). For deeper BLE analysis and active interaction, dedicated BLE tools like GATTacker offer more capability - bettercap's BLE module is best for initial reconnaissance.

HTTP and HTTPS Proxy

Once positioned as MITM (via ARP spoofing), you can enable transparent proxying to inspect and modify web traffic:

set http.proxy.sslstrip true
http.proxy on

The SSL strip functionality attempts to downgrade HTTPS connections to HTTP. It intercepts the initial HTTP request (before the redirect to HTTPS) and maintains an HTTPS connection to the server while serving HTTP to the client.

Modern HSTS (HTTP Strict Transport Security) defeats SSL stripping for sites the browser has previously visited. Chrome, Firefox, and Safari all enforce HSTS, and major sites are on the HSTS preload list. This attack is increasingly limited but still works against some targets.

For HTTPS proxying with certificate interception:

https.proxy on

This generates a self-signed certificate on the fly. Browsers will show certificate warnings, so it only works if the target accepts them (or in environments where you can install a custom CA certificate).

Caplets - Automating Attacks

Caplets are script files (with .cap extension) that automate bettercap commands. Instead of typing commands manually, you write them in a file and load it at startup.

# mitm.cap
net.probe on
set arp.spoof.targets 192.168.1.50
set arp.spoof.fullduplex true
arp.spoof on
set net.sniff.verbose true
net.sniff on

Run it:

sudo bettercap -caplet mitm.cap

bettercap ships with several built-in caplets for common scenarios. You can install the community caplets collection:

sudo bettercap -eval "caplets.update; q"

This downloads caplets for common attack scenarios including credential harvesting, HTTP injection, and WiFi attacks. Review them before use - some are aggressive.

The Web UI

bettercap includes a web-based UI that provides a dashboard for monitoring attacks, viewing discovered hosts, and managing modules visually.

sudo bettercap -caplet http-ui

The default credentials are user/pass (change them). The UI runs on port 80 by default and provides:

• Network map with discovered hosts
• Real-time event log
• Module control panel
• WiFi AP and client display
• BLE device list
• Credential log

The web UI is particularly useful for WiFi auditing because it visualizes access points, clients, and signal strength in a way that is much easier to parse than terminal output.

For team environments, multiple people can connect to the web UI simultaneously to monitor an ongoing assessment.

A note on detection: ARP spoofing is detectable. Tools like arpwatch, most enterprise IDS/IPS systems, and even some consumer routers will flag or block ARP poisoning attempts. Dynamic ARP Inspection (DAI) on managed switches prevents ARP spoofing entirely. Know your environment before attempting these techniques.

This article is for educational and authorized security testing purposes only. Only test on networks you own or have explicit written permission to test. ARP spoofing, DNS spoofing, and traffic interception are illegal without authorization.