Use Bettercap for MITM Attacks

Ever wondered how attackers silently intercept traffic on a network you thought was secure? With Bettercap, a powerful, open-source framework for network reconnaissance and Man-in-the-Middle (MITM) attacks, you can see exactly how that happens — and, more importantly, learn how to defend against it. In this lesson, you’ll gain hands-on experience using Bettercap to intercept, monitor, and manipulate network traffic, turning you from a passive observer into an active security tester.

The Problem This Lesson Solves

Imagine you’re a security engineer responsible for a corporate network. Users complain about slow speeds, but you suspect something more sinister — an attacker sitting between employees and the router, quietly capturing credentials or injecting malicious scripts. Without the right tools, diagnosing this is nearly impossible. Traditional network monitoring gives you logs but not the full picture of what an attacker can do.

Bettercap solves this by giving you a single, modular framework to perform ARP spoofing, DNS spoofing, HTTP/HTTPS interception, and even credential sniffing — all from one command-line interface. It’s the Swiss Army knife of MITM attacks, used by penetration testers and red teams to simulate real-world threats. By mastering Bettercap, you’ll be able to identify vulnerabilities in your own network before an actual attacker exploits them.

Core Concept / Mental Model

Think of a Man-in-the-Middle (MITM) attack like a postal worker who secretly opens your mail, reads it, and then reseals the envelope before delivering it. The sender and receiver never know their correspondence was compromised. In networking, the “mail” is your data packets, and the “postal worker” is the attacker who positions themselves between you and your destination.

Bettercap operates at Layer 2 (Data Link) of the OSI model, primarily using ARP (Address Resolution Protocol) spoofing to redirect traffic. Here’s the simple mental model:

• Normal flow: Your computer → Router → Internet
• MITM flow: Your computer → Attacker (Bettercap) → Router → Internet

Bettercap tricks both your computer and the router into believing it’s the other party, so all traffic flows through the attacker’s machine. This allows for passive sniffing (listening) or active manipulation (injecting, blocking, modifying).

Definitions You Need to Know

• ARP Spoofing: Sending fake ARP messages to associate the attacker’s MAC address with the target’s IP address.
• Sniffing: Capturing and analyzing network traffic.
• HSTS (HTTP Strict Transport Security): A web security mechanism that forces browsers to use HTTPS; Bettercap can bypass it with specific techniques (though this is advanced).

How It Works Step by Step

Here’s the logical sequence of executing a MITM attack with Bettercap:

1. Identify your target: Determine the IP addresses of the devices you want to intercept (e.g., a victim and the router).
2. Enable IP forwarding: Tell your system to forward packets between the victim and router, so the connection doesn’t break.
3. Launch Bettercap: Start the tool and begin ARP spoofing on both the victim and the router.
4. Enable sniffing: Activate the sniffer module to capture traffic (e.g., HTTP requests, credentials).
5. Optionally manipulate: Use modules like http.proxy or dns.spoof to inject content or redirect DNS requests.

This cause-and-effect loop — spoof → sniff → manipulate — is the core of any MITM engagement. Each step is reversible; stopping Bettercap restores normal traffic flow.

Hands-On Walkthrough

Let’s get practical. We’ll use Bettercap to perform a basic ARP spoofing attack and sniff HTTP traffic. We’ll assume you’re on a Linux machine (or WSL) with Bettercap installed. If not, install it first:

# On Debian/Ubuntu
sudo apt update && sudo apt install bettercap
# Or via Go (if you prefer the latest)
go install github.com/bettercap/bettercap@latest

Step 1: Find Your Targets

Open a terminal and run Bettercap with network discovery:

sudo bettercap -iface eth0

Inside the Bettercap interactive shell, run:

net.show

This displays all devices on your network. Note the IP of your target (e.g., 192.168.1.105) and the router IP (e.g., 192.168.1.1).

Step 2: Enable IP Forwarding

Before spoofing, exit Bettercap (Ctrl+C) and enable IP forwarding so traffic flows through your machine without dropping:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

Step 3: Perform ARP Spoofing

Restart Bettercap and run the ARP spoofing module on both targets:

sudo bettercap -iface eth0
# Set the target (victim IP) and the router IP
set arp.spoof.targets 192.168.1.105
set arp.spoof.whitelist 192.168.1.1
arp.spoof on

Pro tip: Always use set arp.spoof.whitelist to avoid spoofing your router itself, which can cause network chaos.

Step 4: Sniff Traffic

Now enable the sniffer to see the intercepted data:

net.sniff on

You’ll start seeing HTTP requests, credentials, and other plaintext traffic. For HTTPS, Bettercap can capture TCP decryption only if the client trusts your CA cert (advanced — we’ll cover that later).

Expected Output Example

[10:45:12] [sys.log] [inf] HTTP request to http://example.com/login from 192.168.1.105
[10:45:12] [net.sniff] [det] [http] GET /login HTTP/1.1  Host: example.com
...

Example 2: DNS Spoofing (Bonus)

To redirect a specific domain to a malicious IP (for testing), use:

set dns.spoof.domains example.com
set dns.spoof.address 10.0.0.5
dns.spoof on

This makes the victim resolve example.com to 10.0.0.5 — a classic MITM trick.

Blockquote: Remember, these attacks are illegal without permission. Always run them in your own lab or with explicit written consent.

Compare Options / When to Choose What

Bettercap isn’t the only tool for MITM attacks. Here’s how it stacks up against alternatives:

When to choose Bettercap: If you need a single tool for multiple attack vectors (ARP spoofing, DNS spoofing, HTTP proxy) and want active community support. Use Mitmproxy if you’re only debugging web traffic; use Ettercap if you’re forced to work on older systems.

Troubleshooting & Edge Cases

Common issues and how to fix them:

1. No traffic captured: Ensure IP forwarding is enabled (cat /proc/sys/net/ipv4/ip_forward shows 1). If it’s 0, re-enable it.
2. Network becomes unresponsive: You’re likely spoofing the router itself. Whitelist the router IP, and never forward ARP packets to it.
3. HSTS / HTTPS traffic not decrypted: Bettercap’s default sniffing only sees cleartext. To intercept HTTPS, you need to configure the http.proxy module with a custom CA and install the CA cert on the victim’s browser. That’s a full lab exercise.
4. Bettercap crashes on high traffic: Increase system file limits or use -no-colors to reduce overhead. Alternatively, only target one host instead of all.
5. Victim’s antivirus blocks the attack: This is rare but happens. In your lab, disable AV on the victim machine for testing.

Blockquote: If you see [sys.log] [err] messages about not being able to forward packets, double-check your iptables rules. Bettercap sets its own, but a firewall might override them.

What You Learned & What’s Next

In this lesson, you’ve learned how to use Bettercap for MITM attacks: you now understand the core concept of MITM, can execute ARP spoofing and DNS spoofing, and can sniff and manipulate traffic. You’ve also seen how to troubleshoot common issues and choose the right tool for the job.

Next, you’ll dive into credential harvesting and post-exploitation techniques, where you’ll use the intercepted data to escalate privileges or pivot within a network. This skill is crucial for real-world penetration tests.

Now, practice in a safe lab — try intercepting traffic on your own home network (with consent) and see if you can identify a login session. Then, keep learning!

Key takeaway: Bettercap is a powerful tool, but with great power comes great responsibility. Always act ethically and within legal boundaries.