Description
Running an internal security assessment means aircrack for WiFi handshakes, ettercap for ARP spoofing, yet another tool for Bluetooth scanning — each with its own command style, and half the effort goes into juggling them. bettercap folds all of it into one framework: a single Go executable covering reconnaissance and man-in-the-middle testing across WiFi, Bluetooth Low Energy, 2.4GHz wireless HID, CAN-bus and Ethernet, with one consistent command syntax.
It gives red teamers and security researchers an all-in-one workbench — scanning, sniffing, spoofing, packet capture and port scanning strung into one flow — plus a convenient Web UI and REST API to script and automate the whole engagement. This is a professional tool built for authorized penetration testing, and should only be used on networks and devices you own or have written permission to test; attacking networks without authorization is illegal in most jurisdictions.
WiFi recon and testing: Scan nearby networks with support for deauth, clientless PMKID association, and automatic WPA/WPA2/WPA3 handshake capture to assess access-point security.
Bluetooth LE scanning: Enumerate BLE device characteristics, read and write them, and probe the low-energy attack surface of smart devices.
Wireless HID testing: Scan 2.4GHz wireless keyboards/mice and perform MouseJacking over-the-air HID frame injection with DuckyScript support to check whether peripherals can be hijacked.
CAN-bus analysis: Built-in DBC parsing to decode, inject and fuzz automotive CAN frames for vehicle-network security research.
MITM spoofing: ARP, DNS, NDP and DHCPv6 spoofers covering IPv4 and IPv6 MITM scenarios, paired with packet-, TCP- and HTTP(S)-level proxies whose logic is customizable via JavaScript plugins.
Sniffing and port scanning: A powerful network sniffer for credential harvesting and protocol fuzzing, plus a very fast port scanner and passive/active host recon.
Web UI and REST API: Drive it visually in the browser, with a REST API and WebSocket async event push to orchestrate multi-step engagements as automated scripts.
It gives red teamers and security researchers an all-in-one workbench — scanning, sniffing, spoofing, packet capture and port scanning strung into one flow — plus a convenient Web UI and REST API to script and automate the whole engagement. This is a professional tool built for authorized penetration testing, and should only be used on networks and devices you own or have written permission to test; attacking networks without authorization is illegal in most jurisdictions.
Features
WiFi recon and testing: Scan nearby networks with support for deauth, clientless PMKID association, and automatic WPA/WPA2/WPA3 handshake capture to assess access-point security.
Bluetooth LE scanning: Enumerate BLE device characteristics, read and write them, and probe the low-energy attack surface of smart devices.
Wireless HID testing: Scan 2.4GHz wireless keyboards/mice and perform MouseJacking over-the-air HID frame injection with DuckyScript support to check whether peripherals can be hijacked.
CAN-bus analysis: Built-in DBC parsing to decode, inject and fuzz automotive CAN frames for vehicle-network security research.
MITM spoofing: ARP, DNS, NDP and DHCPv6 spoofers covering IPv4 and IPv6 MITM scenarios, paired with packet-, TCP- and HTTP(S)-level proxies whose logic is customizable via JavaScript plugins.
Sniffing and port scanning: A powerful network sniffer for credential harvesting and protocol fuzzing, plus a very fast port scanner and passive/active host recon.
Web UI and REST API: Drive it visually in the browser, with a REST API and WebSocket async event push to orchestrate multi-step engagements as automated scripts.
