Bettercap

bettercap is a network attack and monitoring framework written in Go. It targets security researchers, red teamers, and reverse engineers who need one tool to scan, probe, and attack multiple types of networks and devices instead of stitching together separate utilities.

The project bundles WiFi reconnaissance and attacks, BLE device interrogation, wireless HID injection, CAN-bus frame manipulation, and classic IPv4/IPv6 man-in-the-middle techniques into a single portable binary. It ships with a REST API, a websocket event stream, and a web UI, so it works as a standalone CLI tool or as the backend for a custom attack orchestration setup.

Key features

• WiFi attacks: network scanning, deauthentication attacks, the clientless PMKID association attack, and automatic WPA/WPA2/WPA3 handshake capture.
• BLE support: scanning nearby Bluetooth Low Energy devices, enumerating characteristics, and reading/writing them directly.
• MouseJacking: scanning 2.4GHz wireless HID devices and injecting over-the-air HID frames, including DuckyScript payloads.
• CAN-bus and DBC: decoding, injecting, and fuzzing CAN frames for automotive and embedded testing.
• IP network recon: passive and active host probing and discovery on local networks.
• MITM spoofers: ARP, DNS, NDP, and DHCPv6 spoofing for intercepting traffic on IPv4 and IPv6 networks.
• Scriptable proxies: packet-level, TCP-level, and HTTP/HTTPS proxies extendable with JavaScript plugins.
• Sniffer and fuzzer: a network sniffer built for credentials harvesting that doubles as a protocol fuzzer.
• Port scanner: a fast scanner for identifying open services on hosts.
• REST API and web UI: an API with asynchronous websocket event notifications, paired with a web interface for driving attacks interactively.

Ideal use cases

bettercap fits penetration testing engagements where you need to assess WiFi client security, capture WPA handshakes, or test PMKID vulnerability on client-less networks. It's a good fit for red team exercises that combine wireless recon with wired MITM attacks in the same session, since the ARP/DNS/NDP spoofers and scriptable proxies live in the same tool as the WiFi and BLE modules.

It also works well for hardware security testing: probing BLE peripherals for exposed characteristics, testing wireless keyboard/mouse dongles against MouseJacking, or fuzzing CAN-bus frames on a vehicle's onboard network. Teams that want programmatic control can drive it through the REST API and websocket events instead of the interactive shell.

It is not a good fit if you need a passive, read-only monitoring tool for production networks, since many of its modules are designed to actively inject, spoof, or attack. It also assumes you have the legal authority to test the networks and devices involved; running deauth or spoofing attacks on networks you don't own or have permission to test is illegal in most jurisdictions. If you just need a packet capture tool without the attack tooling, a simpler sniffer like tcpdump or Wireshark is a better match.

Installation

bettercap is distributed as prebuilt binaries, a Docker image, and source you can build with Go.

Docker (quickest way to get running):

docker pull bettercap/bettercap
docker run -it --privileged --net=host bettercap/bettercap

From source, with Go installed:

go install github.com/bettercap/bettercap@latest

Prebuilt release binaries for Linux, macOS, and Windows are available on the project's GitHub releases page. Many Linux distributions also package bettercap, so check your distro's package manager first. After installation, most attack modules (WiFi, BLE, packet capture) require running as root or with elevated privileges since they need raw socket and interface access.

Once installed, launch the interactive shell with:

sudo bettercap

From there you can enable modules like net.probe, wifi.recon, or ble.recon, or start the web UI for a graphical view of events and hosts. Full module documentation and usage guides live on the project website.