Instructor: In the previous lectures
we learned how to use Bettercap
to do a number of cool things.
But everything we did, we did it through a text
or a terminal interface.
There is also a web interface or a graphical interface
for Bettercap that we can use to do everything
that I showed you so far.
The reason why I started with the text interface,
because first of all, I actually prefer using it
and I use that instead of the graphical interface
all the time.
I think it's faster,
you can use it to achieve your goal
and launch the attacks much faster.
It also requires less resources and less modules,
therefore it's less likely to fail and it's less buggy.
Not only that,
but by learning how to use the text interface,
I also showed you how to manually modify the caplets
and the scripts where they are stored,
and how to use them properly
without the need for an extra plugin,
which is the plugin that runs the web interface.
With that being said,
some people still think the web interface
is more user-friendly
and that's why I'm gonna cover it in this lecture.
So I'm gonna start Bettercap by typing bettercap,
and I'm gonna do -iface to select my interface
which is eth0.
And I'm not gonna specify a caplet this time,
because I simply just want to start Bettercap
on the interface that is connected to the target network.
So we're gonna hit enter
and that will run with no issues as usual.
Now, if you are using the custom Kali image
that I made for this course,
then you can simply start the web interface
by typing http-ui.
But if you're using the original version of Kali
or if you're using Bettercap on a different distribution,
then you're gonna have to install the web interface,
so you're gonna have to do ui.update to install it,
and then once it's installed, you can simply do http-ui.
Now, like I said,
because I am using the latest custom Kali
that is made for this course,
I can simply run it by typing http-ui
without having to install anything.
And if I hit enter,
you'll see that it's gonna run with no issues
on this URL.
So I'm gonna copy this and we're gonna go,
and open it in my web browser.
And perfect.
As you can see, we get the login page for the web interface,
so the default username is user
and the default password is pass.
I'm gonna click on Login to log in.
And as you can see,
we have a very simple and easy to use interface.
There is no more commands that we have to run,
even though we can run commands here
through the command line.
Right here, we have the event log.
So this is similar to what you see in here in the terminal,
but it's in a much nicer interface.
You can use the search bar here to filter,
if you're looking for a specific log
or for a specific event.
And you can actually click any event type to mute it,
so you won't see any of that event on screen.
All of this is happening in here, in the events menu.
The next useful page would be the land page right here,
which will show you all the devices connected
to the network,
so this is similar to when we used to do net.show.
As you can see right now, we only have the router,
which is a 10.0.2.1,
and my current computer, which is 10.0.2.15, this is Kali.
Now, as you know,
before we have to start the net.recon and net.probe
to discover all of the devices on the same network.
So when here, instead of writing the commands,
all you have to do is click on this play button
to start the net.probe
and click on this play button to start the net.recon,
you'll get nice notifications in here.
And as you can see,
we managed to discover all of the connected devices.
You can also see, and here we have a nice tag
to tell us that this is the gateway
and a nice tag telling us that this is our computer,
and the devices that we discovered are these two devices,
and you can see, this is my MS Edge device,
the windows machine that we have always been targeting.
Again, because this is a very simple web interface,
you won't have to type anything,
you can click on this little arrow right here
beside the machine, beside the IP,
you can either scan this machine for ports
or add it to your spoofing targets.
So you won't have to set arp.spoof.targets to this IP,
all they have to do is literally click here
and it's automatically added to the ARP spoof.
Not only that,
but we'll see a nice little window in here
to configure our ARP spoofer,
and remember we used to set this option to true,
the full duplex,
so all I have to do now is just click here to check it,
and to start this spoofer,
all I have to do is click on start spoofing and done.
Now we should be spoofing the target.
As you can see,
we also see a nice icon in here beside this IP
to tell us that at the moment we are spoofing this IP,
telling it that we are the gateway.
So now if I go to my target and just do arp -a,
you can see that the router's Mac address has changed
to the Mac address of the Kali machine, which is this one.
So that means that we are properly spoofing this device,
telling it that we are the router,
and we managed to become the man in the middle.
Now I've actually showed you how to do all of this before
in details, so if you don't remember any of this,
or if any of this feels strange,
then please go back and revise the lectures
where I covered these things.
Now, I also showed you how to bypass HTTPS
and partially bypass HSTS using a caplet.
Again, we have a nice menu here for caplets.
And as you can see, we have all of the caplets
currently available with Bettercap,
and all you have to do is just click on the caplets
that you want to run,
and in my case, it's the hstshijack caplet.
Also, if you remember, when we were modifying this caplet,
we used to have to open the location
where the caplets are installed
and then open the caplet in a text editor,
and then modify its options.
Whereas in here,
you can literally modify any options you want
within this menu, click on the disk icon right here to save,
and then click on play to run this caplet.
And as you can see,
you get nice notifications telling you
that everything got executed as expected,
and right now we can go ahead and test this.
So if I go here and just clear the browsing data as usual,
and then if I just go to a normal HTTPS page,
such as stackoverflow.com,
you'll see that this will load over HTTP so we can log in
and we should be able to get the username and password,
as I showed you before.
And we can test the partial HSTS bypass,
so if I go to google.ie,
and search for Facebook,
click on the first result,
and perfect.
As you can see, it's loading over normal HTTP here again,
so if I log in the information will be captured
by my sniffer.
So as you can see, it is very, very easy to edit caplets
and even run them through this web interface.
You can also run all of the other plugins
through the advanced menu in here.
So for example, if you wanted to start the sniffer,
all you have to do is just scroll down here,
looking for the sniffer,
and we have it right here, net.sniff,
if I click on that, as you can see on top, it's not running.
And right here, instead of running the commands,
all you have to do is just click on the command
that you want to run.
Not only that,
but if you wanted to modify any of the options,
again, all you have to do is just type
whatever you want to modify in here,
click on the save in here,
and then run the command that you want to run.
So if I wanted to start the sniffer now,
all I have to do is just click on net.sniff on,
and this will start the sniffer for me.
Now, the sniffer combined with the nice events
that we can get in here,
makes it easier to filter through the data that we capture,
but it's still not the best way to filter
through the capture data.
I will cover how to properly sniff data
and filter it using Wireshark,
which is the best tool for sniffing and filtering data.
But again,
this web interface right here provides a nicer way
of interacting and using Bettercap.
Now, I didn't show you how to use the WiFi, the BLE,
the HID and the Position menus,
because we actually did not use
any of these modules previously,
so I just wanted to focus on showing you
how to do everything we've done so far using this interface.
Like I said, it is easier to use, I agree,
but once you get used to the terminal interface,
it will be just as easy as this one.
To me, it's more organized,
it can be used to achieve my goals much quicker,
it uses less resources and it's faster,
that's why I prefer using it over the web interface.
And if it wasn't for showing you
how to use the web interface, I wouldn't even install it.
But at the end of the day, I want to show you both options,
and obviously you're free to use whatever is easier for you.