Bettercap - Revision history

Admin: /* Snooping */

2017-09-06T07:00:13Z

Snooping

← Older revision		Revision as of 07:00, 6 September 2017
Line 161:		Line 161:
	The simplest sniffing scenario is if you're sitting on a network hub (on which all traffic is broadcast to all ports) and sniffing all of the traffic that comes through that port. In this scenario, you have perfect visibility of all the traffic on a network. Normally you cannot sniff traffic because the network card will drop traffic not addressed to it, and because the network card will not forward packets. Sniffing tools fix that.		The simplest sniffing scenario is if you're sitting on a network hub (on which all traffic is broadcast to all ports) and sniffing all of the traffic that comes through that port. In this scenario, you have perfect visibility of all the traffic on a network. Normally you cannot sniff traffic because the network card will drop traffic not addressed to it, and because the network card will not forward packets. Sniffing tools fix that.

	===~~Snooping~~===		===Spoofing===

	TLDR: spoofing is what you do when you '''cannot''' see traffic that is not yours - it's a way of maliciously capturing traffic.		TLDR: spoofing is what you do when you '''cannot''' see traffic that is not yours - it's a way of maliciously capturing traffic.

Admin: /* What is bettercap? */

2017-09-06T06:57:18Z

What is bettercap?

← Older revision		Revision as of 06:57, 6 September 2017
Line 5:		Line 5:
	Bettercap is a better version of [[Ettercap]]. The intention was to create a new tool that worked the same, but better.		Bettercap is a better version of [[Ettercap]]. The intention was to create a new tool that worked the same, but better.

	But what is it, really? It has two objectives: first, it is a tool for sniffing traffic, and second, it is a tool for carrying out man in the middle attacks (~~so that you can sniff~~ the traffic of your network neighbors).		But what is it, really? It has two objectives: first, it is a tool for sniffing traffic, and second, it is a tool for carrying out man in the middle attacks (which enables the first type of attack - sniffing the traffic of your network neighbors).

	Like Ettercap, Bettercap has several nice features:		Like Ettercap, Bettercap has several nice features:

Admin: /* Bettercap DNS Spoofing Attack */

2017-09-06T02:27:09Z

Bettercap DNS Spoofing Attack

← Older revision		Revision as of 02:27, 6 September 2017
Line 370:		Line 370:

	Attempt 2 was a failure. Notes here: [[Bettercap/Failed DNS Spoofing Attack 2]]		Attempt 2 was a failure. Notes here: [[Bettercap/Failed DNS Spoofing Attack 2]]

			kevin2k sez:

			<pre>
			hi, you can add --httpd-port 80 to the command, because http server default port is 80.
			</pre>

	=One-Liners=		=One-Liners=

Admin: /* Ninja Dispatcher Silently Kills Network Connection */

2017-09-06T02:24:27Z

Ninja Dispatcher Silently Kills Network Connection

← Older revision		Revision as of 02:24, 6 September 2017
Line 219:		Line 219:
	Instead of forwarding packets, this switch will make targets connections to be killed.		Instead of forwarding packets, this switch will make targets connections to be killed.

	~~No dear~~ 192.168.1.2, you won’t connect to anything anymore :D		Sorry 192.168.1.2, you won’t connect to anything anymore.

	<pre>		<pre>
	sudo bettercap -T 192.168.1.2 --kill		sudo bettercap -T 192.168.1.2 --kill
	</pre>		</pre>



	=Proxying=		=Proxying=

Admin: /* Sniffing vs Spoofing */

2017-09-06T02:23:39Z

Sniffing vs Spoofing

← Older revision		Revision as of 02:23, 6 September 2017
Line 154:		Line 154:
	* Sniff traffic		* Sniff traffic
	* Spoof traffic from other computers on the network through various attacks		* Spoof traffic from other computers on the network through various attacks

			===Sniffing===

			TLDR: sniffing is what you do when you '''can''' see traffic that is not yours.

	The simplest sniffing scenario is if you're sitting on a network hub (on which all traffic is broadcast to all ports) and sniffing all of the traffic that comes through that port. In this scenario, you have perfect visibility of all the traffic on a network. Normally you cannot sniff traffic because the network card will drop traffic not addressed to it, and because the network card will not forward packets. Sniffing tools fix that.		The simplest sniffing scenario is if you're sitting on a network hub (on which all traffic is broadcast to all ports) and sniffing all of the traffic that comes through that port. In this scenario, you have perfect visibility of all the traffic on a network. Normally you cannot sniff traffic because the network card will drop traffic not addressed to it, and because the network card will not forward packets. Sniffing tools fix that.

			===Snooping===

			TLDR: spoofing is what you do when you '''cannot''' see traffic that is not yours - it's a way of maliciously capturing traffic.

	If you're on a network switch or a wifi network, you will not have visibility of all packets on the network. If you are on a network switch, your port physically does not receive packets not intended for your device. If you are on a wifi network, your wifi card will drop frames not intended for your computer, and even if you kept the frames, you would be missing data, and would have an imperfect picture of the traffic.		If you're on a network switch or a wifi network, you will not have visibility of all packets on the network. If you are on a network switch, your port physically does not receive packets not intended for your device. If you are on a wifi network, your wifi card will drop frames not intended for your computer, and even if you kept the frames, you would be missing data, and would have an imperfect picture of the traffic.

Admin: /* Help */

2017-09-06T02:21:52Z

Help

← Older revision		Revision as of 02:21, 6 September 2017
Line 33:		Line 33:
	</pre>		</pre>

	==Help==		==Bettercap Help and Command Line Options==

	Let's take a look at some of the important flags. Here's the help:		Let's take a look at some of the important flags. Here's the help:
Line 134:		Line 134:
	For examples & docs please visit http://bettercap.org/docs/		For examples & docs please visit http://bettercap.org/docs/
	</pre>		</pre>
	}}

	Important flags are as follow:		===Bettercap Most Important Flags===

			Most important flags are as follow:

	<pre>		<pre>

Admin: /* Help */

2017-09-06T02:21:05Z

Help

← Older revision		Revision as of 02:21, 6 September 2017
Line 37:		Line 37:
	Let's take a look at some of the important flags. Here's the help:		Let's take a look at some of the important flags. Here's the help:

	~~{{Scrollbox\|~~
	<pre>		<pre>
	$ bettercap --help		$ bettercap --help
	~~_ _ _~~
	~~\| \|__ ___\| \|_\| \|_ ___ _ __ ___ __ _ _ __~~
	~~\| '_ \ / _ \ __\| __/ _ \ '__/ __/ _` \| '_ \~~
	~~\| \|_) \| __/ \|_\| \|\| __/ \| \| (_\| (_\| \| \|_) \|~~
	~~\|_.__/ \___\|\__\|\__\___\|_\| \___\__,_\| .__/~~
	~~\|_\| v1.5.7~~
	~~http://bettercap.org/~~



	Usage: bettercap [options]		Usage: bettercap [options]
Line 87:		Line 77:
	--sniffer-output FILE Save all packets to the specified PCAP file ( will enable sniffer ).		--sniffer-output FILE Save all packets to the specified PCAP file ( will enable sniffer ).
	--sniffer-filter EXPRESSION Configure the sniffer to use this BPF filter ( will enable sniffer ).		--sniffer-filter EXPRESSION Configure the sniffer to use this BPF filter ( will enable sniffer ).
	-P, --parsers PARSERS Comma separated list of packet parsers to enable, '' for all ( NOTE: Will set -X to true ), available: FTP, REDIS, TEAMVIEWER, MAIL, SNPP, NTLMSS, WHATSAPP, DHCP, URL, PGSQL, CREDITCARD, IRC, DICT, COOKIE, RLOGIN, NNTP, MYSQL, HTTPS, POST, SNMP, MPD, HTTPAUTH - default:		-P, --parsers PARSERS Comma separated list of packet parsers to enable, '*' for all ( NOTE: Will set -X to true ), available: FTP, REDIS,
			TEAMVIEWER, MAIL, SNPP, NTLMSS, WHATSAPP, DHCP, URL, PGSQL, CREDITCARD, IRC, DICT, COOKIE, RLOGIN, NNTP, MYSQL, HTTPS,
			POST, SNMP, MPD, HTTPAUTH - default: *
	--custom-parser EXPRESSION Use a custom regular expression in order to capture and show sniffed data ( NOTE: Will set -X to true ).		--custom-parser EXPRESSION Use a custom regular expression in order to capture and show sniffed data ( NOTE: Will set -X to true ).

Line 129:		Line 121:
	--custom-https-proxy-port PORT		--custom-https-proxy-port PORT
	Specify a port for the custom HTTPS upstream proxy, default to 8083.		Specify a port for the custom HTTPS upstream proxy, default to 8083.
	--custom-redirection RULE Apply a custom port redirection, the format of the rule is PROTOCOL ORIGINAL_PORT NEW_PORT. For instance TCP 21 2100 will redirect all TCP traffic going to port 21, to port 2100.		--custom-redirection RULE Apply a custom port redirection, the format of the rule is PROTOCOL ORIGINAL_PORT NEW_PORT.
			For instance TCP 21 2100 will redirect all TCP traffic going to port 21, to port 2100.

	SERVERS:		SERVERS:

Admin: /* Bettercap DNS Spoofing Attack */

2016-08-25T07:34:11Z

Bettercap DNS Spoofing Attack

← Older revision		Revision as of 07:34, 25 August 2016
Line 367:		Line 367:
	===Bettercap DNS Spoofing Attack===		===Bettercap DNS Spoofing Attack===

	~~Notes from attempt~~ 1 failure: [[Bettercap/Failed DNS Spoofing Attack]]		Attempt 1 was a failure. Notes here: [[Bettercap/Failed DNS Spoofing Attack]]

	~~Notes from attempt~~ 2 failure: [[Bettercap/Failed DNS Spoofing Attack 2]]		Attempt 2 was a failure. Notes here: [[Bettercap/Failed DNS Spoofing Attack 2]]

	=One-Liners=		=One-Liners=

Admin: /* Firewall Redirect Port 80 to 8081 */

2016-08-25T06:11:26Z

Firewall Redirect Port 80 to 8081

← Older revision		Revision as of 06:11, 25 August 2016
Line 350:		Line 350:
	</pre>		</pre>

	===Firewall Redirect Port 80 to 8081===		===Firewall Redirect Port 80 to 8081 (bad idea)===

			<s>
	The DNS redirection will only redirect sheep to the attacker, not to a port. Redirect all the attacker's port 80 http traffic to port 8081, where the Bettercap HTTP server will be running:		The DNS redirection will only redirect sheep to the attacker, not to a port. Redirect all the attacker's port 80 http traffic to port 8081, where the Bettercap HTTP server will be running:

Line 360:		Line 361:

	You can test this out by typing "localhost" into your browser's address bar - it should redirect you to localhost:8081, and you should see NOPE.		You can test this out by typing "localhost" into your browser's address bar - it should redirect you to localhost:8081, and you should see NOPE.
			</s>

			Actually, the whole reason I had problems with the DNS spoofing was because bettercap was actually already doing this by default. This interferes with traffic your DNS attack is NOT supposed to filter out.

	===Bettercap DNS Spoofing Attack===		===Bettercap DNS Spoofing Attack===

Admin: /* Bettercap DNS Spoofing Attack */

2016-08-25T02:22:04Z

Bettercap DNS Spoofing Attack

← Older revision		Revision as of 02:22, 25 August 2016
Line 364:		Line 364:

	Notes from attempt 1 failure: [[Bettercap/Failed DNS Spoofing Attack]]		Notes from attempt 1 failure: [[Bettercap/Failed DNS Spoofing Attack]]

			Notes from attempt 2 failure: [[Bettercap/Failed DNS Spoofing Attack 2]]

	=One-Liners=		=One-Liners=