Edit

Module 13: bettercap Essentials

Installation and Executing

Installing bettercap:

kali@kali:~$ sudo apt install bettercap

Starting bettercap:

kali@kali:~$ sudo bettercap -iface wlan0
bettercap v2.28 (built for linux amd64 with go1.14.4) [type 'help' for a list of commands]

 wlan0  » help

           help MODULE : List available commands or show module specific help if no module name is provided.
                active : Show information about active modules.
                  quit : Close the session and exit.
         sleep SECONDS : Sleep for the given amount of seconds.
              get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard.
        set NAME VALUE : Set the VALUE of variable NAME.
  read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE.
                 clear : Clear the screen.
        include CAPLET : Load and run this caplet in the current session.
             ! COMMAND : Execute a shell command and print its output.
        alias MAC NAME : Assign an alias to a given endpoint given its MAC address.

Modules

      any.proxy > not running
       api.rest > not running
      arp.spoof > not running
      ble.recon > not running
        caplets > not running
    dhcp6.spoof > not running
      dns.spoof > not running
  events.stream > running
            gps > not running
...

We can change the specified interface with set wifi.interface wlanX in the interactive terminal. If this is done, the terminal will not update to show the new interface being used however it will have changed.

Modules vs. Commands

Wi-Fi Module

Discovering APs

Starting the Wi-Fi module to begin discovering:

Setting the channels to only 6 and 11:

Running the show command to list discovered wireless stations:

Using the ticker module to periodically execute multiple commands:

We can also execute commands upon starting bettercap:

We can stop the execution of ticker via ticker off.

Sorting by Number of Clients
Filtering by WPA2 Encryption

Listing clients by BSSID:

Filtering with regex:

Deauthenticating a Client

Deauthenticating all clients connected to a specific BSSID:

Deauthenticating a single client:

Changing the File and Aggregate settings:

Additional Methods of Interacting with Bettercap

Caplets

Caplets are files that allow us to quickly run a series of commands without having to manually type each one into the interactive terminal. They have a .cap file extension.

The example caplets can be found in /usr/share/bettercap/caplets/.

Caplet for mass deauthentication:

Running a custom caplet:

Web Interface

Configuring nftables on the kali machine running bettercap:

Editing /usr/share/bettercap/caplets/https-ui.cap to set a username and password:

If we wanted to only run bettercap locally, we would use the http-ui caplet instead of the https-ui caplet. The http-ui caplet starts the HTTP listener on the loopback interface instead of on all interfaces.

The HTML and JavaScript loaded on the login page will instruct our browser to make calls to the API server running on port 8083. Because we use a self-signed certificate, and web browsers don't trust them by default, we will need to accept the certificate first. If we don't do this, the API calls will fail.

Accepting the Certificate of the API Server

Navigating to the Advancedtab allows us to inspect our settings, commands, and other information. Scrolling down to the Wi-Fi settings, we can find all the commands and parameters available for the Wi-Fi module.

PreviousModule 12: Attacking WPA EnterpriseNextModule 14: Determining Chipsets and Drivers

Last updated