bettercap

Perform network reconnaissance and MITM attacks with ARP spoofing and traffic sniffing.

15|1|Updated Feb 12, 2026
One-click install
npx skills add https://github.com/AeonDave/malskill --skill bettercap
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: bettercap
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/network/bettercap
Command: npx skills add https://github.com/AeonDave/malskill --skill bettercap

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive toolkit for performing various network attacks and reconnaissance, enabling security professionals to test and understand network vulnerabilities.

Core Features & Use Cases

  • Network Reconnaissance: Discover hosts and devices on the local network.
  • Man-in-the-Middle (MITM) Attacks: Perform ARP spoofing to intercept traffic.
  • Traffic Sniffing: Capture credentials and sensitive information from network traffic.
  • Wireless Attacks: Conduct WiFi deauthentication and probe request attacks.
  • Bluetooth Reconnaissance: Scan for BLE devices.
  • Use Case: When conducting a penetration test on a corporate LAN, use bettercap to discover all active devices, perform ARP spoofing to intercept traffic between a target and the gateway, and then sniff for any exposed credentials.

Quick Start

Execute the command sudo bettercap -iface eth0 to start bettercap with the specified network interface.

Frequently Asked Questions about bettercap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform ARP spoofing and traffic sniffing on a local network?

To perform ARP spoofing and traffic sniffing, run the command `sudo bettercap -iface eth0` to start intercepting traffic and capturing exposed credentials on your local network. This suite provides comprehensive tools for man-in-the-middle attacks and sensitive information harvesting.

Can I conduct WiFi deauthentication and BLE reconnaissance using a single network attack tool?

Yes, you can conduct WiFi deauthentication, probe request attacks, and BLE reconnaissance using this network attack Swiss Army knife. It supports comprehensive wireless attacks and Bluetooth device scanning natively without requiring additional specialized tools.

Do I need root privileges to run bettercap for network reconnaissance?

Yes, you need root or sudo privileges to run bettercap for network reconnaissance and attacks. It operates on Linux and macOS systems, requiring elevated permissions to access raw network sockets and perform tasks like ARP spoofing and packet sniffing.

What is the best way to intercept LAN traffic and harvest credentials during a penetration test?

The best way to intercept LAN traffic and harvest credentials is to use a comprehensive toolkit that discovers active hosts, performs ARP spoofing to intercept gateway traffic, and sniffs for exposed credentials. It provides an all-in-one solution for man-in-the-middle penetration testing scenarios.

Does bettercap support HTTPS SSL stripping scenarios?

Yes, bettercap supports HTTPS SSL stripping scenarios alongside other man-in-the-middle attacks. It enables security professionals to intercept and manipulate traffic, test network vulnerabilities, and expose sensitive information transmitted over encrypted connections.