In the last two lectures we've seen how ARP works, what does ARP Poisoning or Spoofing mean and
how to launch an ARP Poisoning attack using a tool called Ettercap.
We’ll move on to another advanced hacking tool called Bettercap.
For many years Ettercap was the standard tool for performing ARP Poisoning and MITM
attacks on wired or wireless networks.
It's still a very useful tool and for a fast and reliable attack it could be the tool of your choice.
You can install it in just a few seconds on any Linux distribution and launch the attack with only
one command.
However things have evolved and another more advanced tool, called the Bettercap, was released.
It was completely rewritten in Golang and this allows BetterCAP to run on low end hardware while
processing hundreds of connections per second
and forwarding tens of hundreds of packets. Memory and CPU usage are now extremely optimized. BetterCAP
supports Linux, Windows, Mac OS and Android.
Note that it requires a rooted phone. BetterCAP is a powerful flexible and portable tool created
to perform various types of Man in the Middle
Attacks against protocols like ARP, DNS or DHCPv6.
It manipulates HTTP, HTTPS and TCP traffic in real time, sniffs credentials for protocols like HTTP, HTTPS,
FTP, IMAP, POP or SMTP, bypasses HTTPS, performs SSLStripping with HSTS bypass and many more.
more.
It's the Swiss Army knife for network attacks and the monitoring.
Enough talking let's go to work!
I'm gonna use Kai because it has Bettercap in its default repositories and it's easier to install
it; if you use another distribution of Linux
you should install it. Depending on the distribution you are using
you can install it from binary packages using the package manager like apt
or you need to compile it. Let's install Bettercap on KALI.
At the terminal I am becoming root: sudo su and a -sign and I am entering the default password
of Kali user which is Kali.
Okay I'm root!
Let's install Bettercap using apt: apt update && apt install bettercap
okay it's installing bettercap!
Bettercap has been successfully installed! To see a summary of its help you execute bettercap -
h
To start it you execute as root bettercap -i face and the name of the interface that's connected
to the network you want to attack; just run ifconfig to see its name ! In this example I'm starting
bettercap on eth0 which is bridged to the wireless interface of my laptop. Kali is running
in a VM
so bettercap -iface eth0
Once the command gets executed you are in bettercap and you see a different prompt.
This is the bettercap prompt! Bettercap uses modulus for each available attack! To display all its modules
we run help; these are the modules of bettercap.
We see a list of commands, all available modules and which ones are running; the only module that is running
by default is events.stream
which prints out bettercap events as a continuous stream! If you want to see the help of a module you
execute help and the name of the module.
For example help net.probe
and we see the help of the module.
It starts network hosts probing in the background
so in fact it scans the network.
We see that it's not running and that we can start started by typing net probe on.
This is how we started the module and this is how we stop it.
We also notice that this module has some parameters available.
They can be used to fine tune its behavior. Let's start the module! net.probe on We notice that
it has also started another module called net.recon as an requirement! net.probe starting
net.recon as a requirement for a net.probe. If I execute the help comment I see that there are
three modules running: events.stream, net.probe and net.recon Now to see all discovered
hosts on the network I run net.show and I see a list of hosts, their IP and MAC addresses,
name, vendor and so on.
If I want to see a list of all running modules besides the help command I can run active and it's
showing all active modules with their options.