// arsenal·Network AnalysisIntermediateFOSS

Bettercap

Modern reincarnation of Ettercap — Go-based, scriptable, Wi-Fi-aware.

Network Analysis

$ bettercap --help

Bettercap

// what it is

Description

evilsocket's modular MITM and network attack toolkit. ARP spoofing, DNS spoofing, HTTPS proxy, BLE/Wi-Fi attacks, scriptable via 'caplets'. The active option for LAN attacks in 2026.

// use cases

What people use it for

LAN MITM
Wi-Fi handshake capture
BLE reconnaissance

// commands

The commands you'll type

Interactive on eth0

$ bettercap -iface eth0

Run a caplet

$ bettercap -caplet http-ui

// facts

category: Network Analysis
platforms: LIN · MAC
license: FOSS
difficulty: Intermediate

// links

// related in Network Analysis

Network AnalysisBeginner

Wireshark

The reference open-source network protocol analyzer.

FOSS

LIN·WIN·MAC

open entry →

Network AnalysisIntermediate

tcpdump

The command-line packet sniffer that every Unix-like ships with.

FOSS

LIN·MAC

open entry →

Network AnalysisIntermediate

Ettercap

Classic LAN man-in-the-middle framework — ARP poisoning, DNS spoofing, filters.

FOSS

LIN·MAC

open entry →