ARP Spoofing and Traffic Interception with Bettercap

Once connected to a wireless network — whether through legitimate credentials, a recovered PSK, or via an evil twin — ARP spoofing positions your machine as the gateway for other clients on the same segment. Traffic from targeted clients flows through your machine before reaching the real gateway, enabling passive interception of all plaintext protocols and active manipulation of unencrypted sessions. This works on both open networks and networks where you have the PSK.

Connect to the target network with managed mode before starting bettercap. This attack runs from a connected client interface, not a monitor mode interface.

Connect to the Target Network

Start bettercap and Probe the Network

net.probe on sends ARP and mDNS probes to discover all active hosts on the subnet. net.show lists discovered hosts with IP, MAC, vendor, and hostname. Identify the gateway IP and the target client IPs before starting the spoof.

Enable ARP Spoofing

Target a specific client or the entire subnet. To target a specific client and the gateway:

To target all clients on the subnet:

Enable IP forwarding so intercepted traffic still reaches the gateway — without this the targets lose internet connectivity which is noisy:

Capture Credentials with net.sniff

net.sniff on captures and displays credentials from plaintext protocols including HTTP, FTP, SMTP, and others automatically. bettercap parses and highlights credential-bearing packets in the output.

To write all captured traffic to a pcap file for later analysis:

HTTP Proxy for SSL Stripping

To downgrade HTTPS connections to HTTP where possible, enable the HTTP proxy with SSL stripping:

SSL stripping success depends on whether the target site uses HSTS preloading. Sites with HSTS enforce HTTPS at the browser level and cannot be stripped. Sites without HSTS or with short max-age values are candidates for downgrade.

Stop the Attack

Stop ARP spoofing cleanly to restore normal ARP tables on targeted clients: