Wireless Attacks with Bettercap

bettercap provides a unified interface for wireless reconnaissance, deauthentication, and handshake capture through its wifi module. It handles monitor mode internally and presents a live view of discovered APs and clients. For wireless work it is most useful as a quick scanning and deauth tool, and as an alternative to the airodump-ng and aireplay-ng workflow when you want everything in one interactive session.

Start bettercap on the Wireless Interface

bettercap drops you into an interactive session. All subsequent commands run inside this session.

Enable Wireless Reconnaissance

Start the wifi module to begin scanning for APs and clients:

Show all discovered APs:

The table shows BSSID, SSID, channel, signal strength, encryption, and connected client count. Refresh periodically to pick up newly discovered APs.

Deauthenticate a Specific Client

Target a specific client MAC for deauthentication:

To deauthenticate all clients from a specific AP:

Capture Handshakes

bettercap writes captured handshakes to pcap files automatically when wifi.recon is active. Set the output directory:

Combine with deauth to force handshakes:

Captured handshakes are saved as individual pcap files per BSSID in the specified directory. Convert them with hcxpcapngtool for hashcat cracking.

Lock to a Specific Channel

To focus the wifi module on a single channel rather than hopping:

Use a Caplet for Automation

Caplets are bettercap script files that automate sequences of commands. Create a caplet for a repeatable wireless scan and deauth workflow:

/tmp/wireless-recon.cap