OSWP · Module 14
bettercap Essentials
Use bettercap for wireless recon, deauthentication, and handshake capture, then ARP spoofing and traffic interception after network access.
~1 h 2 resources Last updated September 27, 2026
bettercap is an all-in-one network attack framework with strong 802.11 support. PEN-210 uses it as a complement to the Aircrack-ng suite: reconnaissance, targeted deauthentication, and handshake capture on the wireless side, then ARP spoofing and traffic interception once you are on a network. Its module system and caplets let you script repeatable attacks, though on the exam you drive it interactively.
Wireless Attacks with bettercap
bettercap's wifi module scans for APs and clients, deauthenticates a specific client to force a reconnect, and captures the resulting WPA handshake, covering the same capture workflow as airodump-ng plus aireplay-ng from one console. Locking to a channel keeps the capture focused, and caplets automate multi-step sequences.
Traffic Interception
Once connected to a network, bettercap performs ARP spoofing to place itself between clients and the gateway, then sniffs traffic for credentials with net.sniff and can strip SSL to expose HTTPS content. This turns wireless access into a man-in-the-middle position over the wired-equivalent traffic of every client on the segment.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.