Sniffing & Spoofing

bettercap

bettercap is the modern successor to the old MITM tools, and it’s enormous in scope. One tool covers network reconnaissance, ARP/DNS spoofing, transparent proxies that rewrite traffic, credential sniffing, Wi-Fi attacks, Bluetooth Low Energy, and more — all through a modular system of “caplets” (scripts) and an interactive session or web UI. Where ettercap does LAN ARP poisoning well, bettercap does that and a dozen other network attacks from the same console.

Official-repo package; Security → Sniffing & Spoofing → bettercap. It needs raw-socket privileges, so it runs under sudo — this is one of the tools whose menu launcher exists precisely because running it bare would fail on permissions.

The help it prints

Usage of bettercap:
  -autostart string
    	Comma separated list of modules to auto start. (default "events.stream")
  -caplet string
    	Read commands from this file and execute them in the interactive session.
  -caplets-path string
    	Specify an alternative base path for caplets.
  -cpu-profile file
    	Write cpu profile file.
  -debug
    	Print debug messages.
  -env-file string
    	Load environment variables from this file if found, set to empty to disable environment persistence.
  -eval string
    	Run one or more commands separated by ; in the interactive session, used to set variables via command line.
  -gateway-override string
    	Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
  -iface string
    	Network interface to bind to, if empty the default interface will be auto selected.
  -mem-profile file
    	Write memory profile to file.
  -no-colors
    	Disable output color effects.
  -no-history
    	Disable interactive session history file.
  -pcap-buf-size int
    	PCAP buffer size, leave to 0 for the default value. (default -1)
  -script string
    	Load a session script.
  -silent
    	Suppress all logs which are not errors.
  -version
    	Print the version and exit.

Examples

# Start an interactive session on an interface
sudo bettercap -iface eth0

# Run a caplet non-interactively
sudo bettercap -iface eth0 -caplet http-ui

# Inside the interactive session, a common MITM sniff:
#   > net.probe on         (discover hosts)
#   > set arp.spoof.targets 10.0.0.5
#   > arp.spoof on
#   > net.sniff on

bettercap’s interactive help (help inside the session) lists every module and its options; net.recon, arp.spoof, dns.spoof, net.sniff, and http.proxy are the ones you’ll reach for most.