bettercap

bettercap is the modern successor to the old MITM tools, and it’s enormous in scope. One tool covers network reconnaissance, ARP/DNS spoofing, transparent proxies that rewrite traffic, credential sniffing, Wi-Fi attacks, Bluetooth Low Energy, and more — all through a modular system of “caplets” (scripts) and an interactive session or web UI. Where ettercap does LAN ARP poisoning well, bettercap does that and a dozen other network attacks from the same console.

It lives at Security → Sniffing & Spoofing → bettercap. It needs raw-socket privileges, so it runs under sudo — this is one of the tools whose menu launcher exists precisely because running it bare would fail on permissions.

The help it prints

Show the full output33 lines
Usage of bettercap:
  -autostart string
    	Comma separated list of modules to auto start. (default "events.stream")
  -caplet string
    	Read commands from this file and execute them in the interactive session.
  -caplets-path string
    	Specify an alternative base path for caplets.
  -cpu-profile file
    	Write cpu profile file.
  -debug
    	Print debug messages.
  -env-file string
    	Load environment variables from this file if found, set to empty to disable environment persistence.
  -eval string
    	Run one or more commands separated by ; in the interactive session, used to set variables via command line.
  -gateway-override string
    	Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
  -iface string
    	Network interface to bind to, if empty the default interface will be auto selected.
  -mem-profile file
    	Write memory profile to file.
  -no-colors
    	Disable output color effects.
  -no-history
    	Disable interactive session history file.
  -pcap-buf-size int
    	PCAP buffer size, leave to 0 for the default value. (default -1)
  -script string
    	Load a session script.
  -silent
    	Suppress all logs which are not errors.
  -version
    	Print the version and exit.

Examples

# Start an interactive session on an interface
sudo bettercap -iface eth0

# Run a caplet non-interactively
sudo bettercap -iface eth0 -caplet http-ui

# Inside the interactive session, a common MITM sniff:
#   > net.probe on         (discover hosts)
#   > set arp.spoof.targets 10.0.0.5
#   > arp.spoof on
#   > net.sniff on

bettercap’s interactive help (help inside the session) lists every module and its options; net.recon, arp.spoof, dns.spoof, net.sniff, and http.proxy are the ones you’ll reach for most.