Caplets
Caplets are files that allow us to quickly run a series of commands
without having to manually type each one into the interactive terminal.
Caplet files have a .cap file extension.
We can write our own caplets,
but let’s examine one of the examples rovided in the bettercap directory.
The commands executed in this script should be familiar.
On line 1,
the script customizes the prompt with a yellow background
a white foreground (fw),
the interface name,
and two bold right pointing arrows.
Line 4 sets the ticker period to be executed every 10 seconds.
Line 5 sets the commands to clear the terminal and deauthenticate every client.
Line 10 starts the 802.11 discovery,
and line 11 starts the ticker.
Finally, lines 12 and 13,
clear the terminal and the event stream buffer.
Since massdeauth deauthenticates every client,
we’re not going to use it.
Instead,
we’ll write our own to consistently deauthenticate
any users on the Corporate AP.
Line 1 sets the terminal to use a red background,
with white text.
It also includes commands to display the amount of bytes received
in a human-readable format,
as well as the interface name,
and two white arrows.
On line 3, we set the ticker to run every 10 seconds.
On line 4, we set the ticker commands.
The ticker will clear the screen and then show the table of stations discovered.
Next, it displays the events that have been captured,
then it deauthenticates all clients on the Corporate AP.
The displayed events might be more overwhelming than useful,
so on lines 6, 7, and 8
we prevent the new AP, client probe,
and new client notifications from being written to the event stream.
Lines 10 and 11 will start the recon command and the ticker.
Finally, on line 12 and 13, we clear the event stream buffer and the terminal.
There are a few different ways we could run this caplet
First, if we already have an existing terminal session running,
we can use the include command,
and pass in the caplet we would like to run.
If we don’t already have an interactive session running,
we can use the -caplet argument when starting bettercap.
If we run this caplet for long enough,
we should observe the deauthentication messages
and the handshake capture messages.
Excellent!
The log message includes the location of the saved .pcap file.
From here,
we could use the captured packets to attempt to crack the WPA2 password.