Bettercap
Bettercap is a modular framework for network reconnaissance and man-in-the-middle testing on Wi-Fi, Bluetooth LE and Ethernet networks.
Legal & ethical use. Man-in-the-middle techniques are illegal against networks and people you have no permission to test. Use an isolated lab. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Demonstrate ARP spoofing and sniffing in an isolated lab
- Audit your own Wi-Fi and LAN for weaknesses
Key features
- Interactive session with modules
- Network probing and sniffing
- Caplets for repeatable scripts
Installation
Follow the installation page of the documentation (packages, releases or building from source).
Beginner usage guide
Use it only on a closed lab network; start with passive modules such as net.probe and net.show to see hosts before trying anything active.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Start and discover hosts (interactive)
sudo bettercap -iface eth0Then type `net.probe on` and `net.show` inside the session to list discovered devices.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.