bettercap
bettercap -iface eth0
net.probe on
net.recon on
net.sniff on
bettercap is a versatile suite for network reconnaissance and MiTM attacks. It excels at ARP spoofing, System manipulation, HTTPS stripping, and credential interception across Wi‑Fi, Bluetooth LE, and Ethernet. Essentially, it's a modern Swiss Army knife for Sniffing and manipulating network traffic.
BetterCAP is a powerful, easily extensible, and portable security tool used by security researchers, ethical hackers, and red teamers primarily for performing reconnaissance and active attacks on various networks, including Ethernet and wireless environments.
Core Identity and Classification
- Type: BetterCAP is described as a portable framework written in the Go programming language.
- Target Audience: It aims to offer an easy-to-use, all-in-one solution for security researchers, red teamers, and reverse engineers.
- Security Context: BetterCAP is listed specifically as an ARP Spoofing/Poisoning tool and a Session Hijacking Tool.
Primary Functionality and Attack Capabilities
BetterCAP is designed to facilitate active network interference, primarily focusing on Man-in-the-Middle (MITM) attacks and network reconnaissance:
MITM Attacks
One of the main features of BetterCAP is its ability to perform MITM attacks on both IPv4 and IPv6 networks. It achieves this through built-in spoofing capabilities:
- ARP Spoofing: Used for MITM attacks on IPv4 networks. ARP poisoning/spoofing tools like BetterCAP redirect packets from a target host (or all hosts) on the LAN by forging ARP replies.
- DNS, NDP, and DHCPv6 Spoofing: These are included in the tool for carrying out MITM attacks.
Network Targets
It supports attacking and performing reconnaissance on various network types, including:
- Wi-Fi networks
- Ethernet networks (IPv4/IPv6 based networks)
- Bluetooth Low Energy (BLE) devices
- Wireless Human Interface Device (HID) devices
Session Hijacking
Attackers can use BetterCAP, alongside tools like OWASP ZAP and Hetty, to hijack a session between a client and a server. The tool facilitates reconnaissance and attacking networks.
Exploiting Network Flaws
The successful execution of an MITM attack using a tool like BetterCAP, often relying on ARP spoofing, exploits the fundamental structure of local networks:
- In an ARP poisoning attack, BetterCAP can obtain the Address Resolution Protocol (ARP) cache, and subsequently, the MAC address is replaced with that of the attacker's system.
- This redirection ensures that traffic flowing from the victim to the gateway is instead sent to the attacker's system.
Usage Examples
Basic Interface Setup
bettercap -iface eth0
Network Reconnaissance
net.probe on
net.recon on
Network Sniffing
net.sniff on
Comprehensive MITM Attack
bettercap -iface eth0 -eval "set http.proxy.sslstrip true; set net.sniff.verbose true; set net.sniff.output /root/mitm.pcap; set arp.spoof.fullduplex true; set arp.spoof.internal true; net.recon on; net.probe on; arp.spoof on; http.proxy on; net.sniff on"
Technical Details and Availability
The official source for BetterCAP is its website, https://www.bettercap.org. It is described as a portable framework. A command-line screenshot shows BetterCAP running on a Parrot Terminal.