Bettercap Basics - Ethical Hacking Guide

Introduction to Bettercap

Bettercap is a powerful network attack and monitoring tool that extends beyond the capabilities of simpler tools like ARP Spoof. While ARP Spoof is focused on ARP poisoning attacks, Bettercap provides a comprehensive suite of network attack, monitoring, and analysis capabilities.

Figure 1: Comparison between ARP Spoof and Bettercap capabilities

Bettercap's extensive functionality includes:

ARP spoofing to intercept network connections
Data capture and analysis for extracting credentials
Bypassing HTTPS encryption and potentially HSTS
DNS spoofing for redirecting traffic
Code injection into loaded web pages
Network device discovery and reconnaissance

Running Bettercap

Bettercap comes pre-installed on Kali Linux, making it readily available for ethical hacking tasks. To launch the tool, use the following command in your terminal:

bettercap --iface eth0

Where eth0 is the network interface connected to the target network. You can determine your network interfaces by running the ifconfig command before launching Bettercap.

Note:

For detailed information about Bettercap commands and options, you can use the --help flag:

bettercap --help

Once inside Bettercap, you'll see a different prompt where you can run Bettercap-specific commands. To get a list of all available commands, simply type:

help

This will display all the commands and modules available in Bettercap.

Understanding Bettercap Modules

Bettercap operates using modules, which are specialized components for different types of network tasks and attacks. The only module that runs by default is events.stream, which handles the event system in the background.

To get help with a specific module, use the following command format:

help [module_name]

For example:

help net.probe

Figure 2: Bettercap module relationships and dependencies

Example: Network Discovery with net.probe and net.recon

Two of the most useful modules for initial reconnaissance are net.probe and net.recon:

The net.probe Module

This module sends UDP packets to discover devices on the network. To activate it:

net.probe on

When you activate net.probe, Bettercap will automatically start discovering clients on your network and will also automatically activate the net.recon module.

The net.recon Module

This module monitors the ARP cache and builds a list of discovered devices. Once it's running, you can view discovered devices with:

net.show

This command displays a table with information about all connected clients, including:

IP addresses
MAC addresses
Device types (gateway, host, etc.)
Manufacturer information based on MAC address

Example Output

When running net.show, you might see output similar to this:

IP	MAC	Hostname	Manufacturer	Type
10.0.2.1	52:54:00:12:35:00	gateway	Realtek Semiconductor	gateway
10.0.2.5	08:00:27:11:3b:8c	kali	PCS Systemtechnik	this device
10.0.2.7	08:00:27:92:c4:9d	win-target	Intel Corporate	host

Command Reference

Here are some key Bettercap commands to get you started:

Command	Description
help	Show all available commands and modules
help [module]	Show help for a specific module
net.probe on	Start network device discovery
net.probe off	Stop network device discovery
net.show	Show discovered network devices
arp.spoof on	Start ARP spoofing (requires configuration)
net.sniff on	Start packet capture

Key Takeaways

Bettercap is a versatile tool for network attacks that goes beyond simple ARP spoofing
It operates through modules that can be enabled or disabled as needed
The net.probe and net.recon modules work together to discover network devices
Bettercap can automatically manage related modules (e.g., starting net.recon when net.probe is activated)
The tool provides detailed information about network devices, including IP addresses, MAC addresses, and device types
In upcoming tutorials, you'll learn to use Bettercap for ARP spoofing to intercept data and capture credentials

Ethical Reminder:

The techniques described in this guide should only be used in environments where you have explicit permission to conduct security testing. Unauthorized network interception is illegal in most jurisdictions and violates privacy laws.