Powerful MITM framework for WiFi, Bluetooth, and wired network attacks with an interactive command console.
bettercap -I {interface} -X 🌍 interface → eth0 bettercap -I {interface} -XSandbox: execFile · Timeout: 86400s
network.mitm network.sniff network.deauth network.proxy network.dns.spoof network.arp.spoof | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
interface | string | No | - | Network interface name | -I, --interface |
target | string | No | - | Target IP address | -T, --target |
gateway | string | No | - | Gateway IP address | -G, --gateway |
spoof | boolean | No | - | Enable ARP spoofing | -S, --spoof |
sniffer | boolean | No | - | Enable sniffer | -X, --sniffer |
proxy | boolean | No | - | Enable HTTP/HTTPS proxy | -P, --proxy |
log | string | No | - | Log file path | -L, --log |
output | string | No | - | Output directory | -O, --output |
caplet | file | No | - | Caplet script file to execute | --caplet |
eval | string | No | - | Evaluate a bettercap command | -eval, --eval |
no-http | boolean | No | - | Disable HTTP server | --no-http |
no-https | boolean | No | - | Disable HTTPS server | --no-https |
D | boolean | No | - | Enable debug mode | -D, --debug |
M | boolean | No | - | Start specific module | -M, --module |
dns | boolean | No | - | Spoof DNS record | --dns |
eval-command | string | No | - | Evaluate a command | -eval, --eval |
no_color | boolean | No | - | Disable colored output | --no-color |
proxy_port | boolean | No | - | Proxy listen port | --proxy-port |
v | boolean | No | - | Verbose output | -v, --verbose |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
network.capture.pcap | Captured network traffic | application/vnd.tcpdump.pcap | - | verified |
network.log.sniffed | Sniffed credentials and data | text/plain | - | verified |
Inputs
network.interface Network interface
network.target.ip Target IP address
network.gateway.ip Gateway IP address
Outputs
network.capture.pcap Packet capture file
network.log.credentials Captured credentials
network_trafficnetwork_trafficnetwork_traffic Produces
network.capture.pcapnetwork.log.credentialsConsumes
network.interfacenetwork.target.ipnetwork.gateway.ip| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 256 MB |
| Network | high |
| Disk I/O | medium |
Start sniffer on interface
bettercap -I eth0 -XARP spoof target with sniffer
bettercap -I eth0 -T 192.168.1.100 -X --spoofMITM with proxy and logging
bettercap -I eth0 -T 192.168.1.100 -G 192.168.1.1 -P --proxy -L cap.logRun a caplet script
bettercap -I eth0 --caplet /path/to/caplet.capEvaluate commands inline
bettercap -eval "net.sniff on; set arp.spoof.targets 192.168.1.100; arp.spoof on"Sniffer with DNS spoofing
bettercap -I eth0 -X --dns example.com=10.0.0.1Capture output to file
bettercap -I eth0 -X -O /tmp/captureDisable HTTP/HTTPS servers
bettercap -I eth0 -X --no-http --no-httpsBettercap is a powerful, modular, and portable MITM framework capable of attacking WiFi, Bluetooth Low Energy, and wired networks. It features an interactive console with real-time monitoring.