Network analysis · Open source (GPLv3)

Bettercap

Bettercap is a free, open-source, modular framework for network reconnaissance and man-in-the-middle (MITM) attacks. It brings together tools for scanning and attacking Wi-Fi, Bluetooth Low Energy, wireless HID devices and IPv4/IPv6 networks in a single interactive console. Testers use it for ARP spoofing, traffic sniffing, DNS spoofing, HTTP/HTTPS proxying and credential capture. It is often described as a modern, more capable successor to the older Ettercap for MITM work.

Last updated: 6 August 2026

What Bettercap is actually used for

Bettercap positions your machine in the middle of network traffic and gives you modules to act on it. A tester probes the LAN to discover hosts, ARP-spoofs a target to route its traffic through their machine, then sniffs for credentials or runs an HTTP proxy to inspect and modify web traffic, all from one console with scriptable caplets. Beyond wired LAN MITM it covers Wi-Fi (deauth, handshake capture), BLE enumeration and more. It is used to demonstrate how much can be intercepted on a poorly segmented or unencrypted network.

Platforms

Linux · Windows · macOS

Licence

Open source (GPLv3)

Commands worth knowing

sudo bettercap -iface eth0

Start bettercap bound to a specific network interface.

net.probe on

Actively discover hosts on the local subnet.

set arp.spoof.targets 10.10.10.5

Choose the target host(s) to man-in-the-middle.

arp.spoof on

Begin ARP spoofing to route the target's traffic through you.

net.sniff on

Capture and parse traffic, surfacing credentials and interesting data.

set dns.spoof.domains example.com; dns.spoof on

Spoof DNS responses for chosen domains.

caplets.show

List reusable caplet scripts that automate multi-step attacks.

The legal line

MITM attacks intercept and can alter other people's traffic, so bettercap is lawful only on networks you own or are explicitly authorised to test. ARP/DNS spoofing and sniffing against users without consent is unauthorised access and illegal interception under the IT Act 2000, and it can break connectivity for real users. Use it strictly within an authorised, scoped lab or engagement.

What Bettercap is bad at

Widespread HTTPS, HSTS and certificate pinning defeat plaintext interception and SSL-strip style attacks, so much modern traffic yields only metadata. ARP spoofing works only within the local broadcast domain and can be detected or disrupt the network. It is a loud, active technique that dynamic ARP inspection and network segmentation can block.

Alternatives, and when to pick them

Tool	Pick it when
Ettercap	You want the older, established MITM tool that bettercap was designed to replace.
Responder	You are poisoning LLMNR/NBT-NS/mDNS to capture hashes on Windows networks.
mitmproxy	You want a focused, scriptable HTTPS interception proxy rather than a full LAN attack suite.
Wireshark	You only need to capture and analyse traffic, not actively intercept it.
Aircrack-ng suite	Your focus is specifically WPA/WPA2 handshake capture and cracking.

Where we teach it

Ethical Hacking Course (6 months) — network attacks and MITM module

We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.

Bettercap — FAQs

What is Bettercap used for?

▾

Bettercap is a framework for network reconnaissance and man-in-the-middle attacks. It handles host discovery, ARP and DNS spoofing, traffic sniffing, HTTP/HTTPS proxying, and also Wi-Fi and BLE attacks, all from one modular console.

Is Bettercap better than Ettercap?

▾

Bettercap is the more modern, actively maintained tool with broader capabilities (Wi-Fi, BLE, scriptable caplets, a web UI) and is generally preferred for new work. Ettercap is older and more limited but still referenced in many tutorials.

Can Bettercap read HTTPS traffic?

▾

Not the encrypted content, in general. HTTPS, HSTS and certificate pinning prevent transparent interception, so on modern sites you usually see only metadata. SSL-strip-style tricks are largely defeated by current browsers and site protections.

Bettercap sirf apne network par chalana chahiye kya?

▾

Haan. ARP/DNS spoofing doosron ka traffic intercept karta hai, jo bina permission gair-kanooni hai aur network tod sakta hai. Ise sirf apne lab ya authorised engagement mein hi use karein.

Learn Bettercap properly, in a legal lab

Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.

Call +91 75175 72000