In the last two lectures I have shown you how to use Bettercap to launch various attacks of type Man
in the Middle or Denial of Service
exploiting the ARP protocol. Each time you want to launch an ARP spoofing attack you have to start the
Bettercap, specified the targets, set to different options and start the required modulus.
This is time consuming and prone to errors and to be honest it's not the pleasure to anyone to memorize
tens of parameters and commands.
Fortunately Bettercap has a feature called CAPLETS that allows you to script and automate all supported
attacks.
What is a caplet? It's a text file that contains the options and commands that you would execute in a bettercap
interactive session.
A caplet is similar to a shell script,
instead of writing command after command in a bettercap interactive session you just write the commands
in a text file with .cap extension and then start bettercap using -caplet option and that
file.
Let's see an example! Back to Kali
I'm opening bettercap
just like before and launching an ARP spoofing attack.
I'm becoming root and bettercap-iface
eth0
the name of the interface! Bettercap has started and I'll write first
commands in this interactive session. net.recon on set.arp.spoof.targets
and the name of the target, the Windows machine.
OK.
This one!
set arp.spoof.fullduplex true
and I'm starting the module: arp.spoof on and net.sniff on
perfect.
This is the way you've already seen in the last lectures.
I wanted to execute the commands in bettercap just to be sure that there are no mistakes; now using
my preferred text editor, which is in my case vim,
I'm gonna create a text file called arp_spoof.cap ; I need another terminal, I'm becoming
root, I'm a moving to / root/ directory and here I'm creating the file arp_spoof.cap
Inside this file I'm gonna copy paste all options and commands executed in bettercap interactive
session; the first option,
the second option, the third option and the last two options
and I'm saving the file; I'm closing this instance of bettercap and then started again this time using
the caplet.
First I'm moving to /root /directory.
This is the directory that contains the caplet.
This is the file.
Be sure that the caplet is in the current working directory.
If it's not, use correct absolute or relative path to the caplet file: bettercap -iface
eth0 -caplet and the name of the file. I'm closing this terminal just to have more space
and I'm hitting enter and bettercap started and has launched the ARP spoofing attack just as we would
have written all the commands directly in bettercap session. Let's test that the attack is working!
This is the victims machine and I'm executing arp- a ;this is its ARP table and we notice that
both the default gateway and the hacker have the same MAC address in the ARP table; now using the browser
I'm going to log in to the same website we've tested at ARP spoofing attack: demo.testfire.net
and I'll click on online banking log in; useer name Kali and password test
1 2 3 4
and log in
We notice how the attacker has captured the credentials so the attack is working. Now if you want to
add a new target , change an option or launch a second attack you just modified the caplet and
start bettercap again. It's much simpler this way! Note that the bettercap already comes
with some caplets and you may find them in usr/share/ bettercap and caplets. These are the caplets
bettercap is coming with.
In bettercap interactive session you can see all caplets by executing caplets.show
We see the name of the caplet and the caplet file and the path to the caplet, caplet.path
it will search for the caplets in these directories and there is also caplet.update available,
it will updated the caplets from the official github repository.
Note that this command is inactive in Kali by default.
If you want to activate the command you must install bettercap-caplets package.
Also take care that
this command will overwrite any changes you have done to the caplets in the official directory.