Skip to content
HackIndex.io

Wireless Attacks with Bettercap

3 min read Created Mar 17, 2026 Last updated Mar 17, 2026

bettercap provides a unified interface for bettercap wireless attacks including reconnaissance, deauthentication, and handshake capture through its wifi module. It handles monitor mode internally and presents a live view of discovered APs and clients. For wireless work it is most useful as a quick scanning and deauth tool, and as an alternative to the airodump-ng and aireplay-ng workflow when you want everything in one interactive session.

Compared to the aircrack-ng suite, bettercap trades granular control for convenience. aircrack-ng gives you separate tools with full flag control, which matters when you need to filter by BSSID or work on specific channels reliably. bettercap is faster to set up for quick scans and deauth bursts but lacks the capture reliability of airodump-ng in long-running sessions. Use bettercap when you need a fast interactive overview, fall back to the aircrack-ng suite when you need stable, long-duration captures or when driver compatibility is a concern.

Start Bettercap for Wireless Attacks

┌──(kali㉿kali)-[~]
└─$ bettercap -iface wlan0

bettercap drops you into an interactive session. All subsequent commands run inside this session.

If bettercap fails to start with a driver error or cannot enable monitor mode, the adapter likely does not support the cfg80211 or mac80211 interfaces that bettercap expects. Check iw list for monitor mode support. Some Realtek chipsets (RTL8812AU, RTL8188EUS) require the adapter to be placed in monitor mode manually with airmon-ng start wlan0 before bettercap will work.

Enable Wireless Reconnaissance

Start the wifi module to begin scanning for APs and clients:

┌──(kali㉿kali)-[~]
└─$ wifi.recon on

Show all discovered APs:

┌──(kali㉿kali)-[~]
└─$ wifi.show

The table shows BSSID, SSID, channel, signal strength, encryption, and connected client count. Refresh periodically to pick up newly discovered APs.

Deauthenticate a Specific Client

Target a specific client MAC for deauthentication:

┌──(kali㉿kali)-[~]
└─$ wifi.deauth CC:DD:EE:FF:AA:BB

To deauthenticate all clients from a specific AP:

┌──(kali㉿kali)-[~]
└─$ wifi.deauth AA:BB:CC:DD:EE:FF

Capture Handshakes

bettercap writes captured handshakes to pcap files automatically when wifi.recon is active. Set the output directory:

┌──(kali㉿kali)-[~]
└─$ set wifi.handshakes.file /tmp/handshakes
┌──(kali㉿kali)-[~]
└─$ wifi.recon on

Combine with deauth to force handshakes:

┌──(kali㉿kali)-[~]
└─$ wifi.deauth AA:BB:CC:DD:EE:FF

Captured handshakes are saved as individual pcap files per BSSID in the specified directory. Convert them with hcxpcapngtool for hashcat cracking.

OPSEC Considerations for Bettercap Wireless Attacks

bettercap wireless attacks generate noticeable traffic that WIDS/WIPS systems can detect. Keep the following in mind:

  • Deauthentication frames are the most visible indicator. Enterprise WIDS (Cisco, Aruba) alert on deauth floods within seconds.
  • bettercap does not spoof the source MAC of deauth frames by default, so your adapter MAC is logged in any captures.
  • Channel hopping during wifi.recon is detectable by nearby monitoring setups that see your adapter appear and disappear on channels rapidly.
  • Locking to a single channel with wifi.recon.channel reduces your footprint but limits visibility to that channel only.
  • The bettercap web UI (if enabled) binds to all interfaces by default. Disable it or bind to 127.0.0.1 to avoid exposing it on the target network.

Lock to a Specific Channel

To focus the wifi module on a single channel rather than hopping:

┌──(kali㉿kali)-[~]
└─$ wifi.recon.channel 6

Use a Caplet for Automation

Caplets are bettercap script files that automate sequences of commands. Create a caplet for a repeatable wireless scan and deauth workflow:

/tmp/wireless-recon.cap

set wifi.handshakes.file /tmp/handshakes
wifi.recon on
sleep 30
wifi.show
wifi.deauth AA:BB:CC:DD:EE:FF
sleep 10
wifi.show
┌──(kali㉿kali)-[~]
└─$ bettercap -iface wlan0 -caplet /tmp/wireless-recon.cap

References