bettercap

No entries match these filters. Clear filters

1. v2.41.5 Dec 15, 2025 · release notes

   bettercap v2.41.5 adds pcapng capture format, new BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems./LAN/WiFi count APIs, and JS filesystem helpers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.41.5 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.41.5

   • Supports pcapng format for modern, richer packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. output.
   • New ble.NumDevices() session variable returns count of discovered BLE devices.
   • New lan.NumHosts() session variable returns count of discovered LAN hosts.
   • New wifi.NumAPs() session variable returns count of discovered WiFi access points.
   • Exposes BLEDeviceJSON for external programmatic use.

   +2 more show less

   • Adds JS mkdirAll function for directory creation in caplets.
   • Adds JS appendFile function for file append operations in caplets.

   7 details in Everything

2. v2.41.2 Aug 18, 2025 · release notes

   bettercap v2.41.2 adds default API credentials to simplify initial setup and access control.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.41.2 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.41.2

3. v2.41.1 Jul 15, 2025 · release notes

   bettercap v2.41.1 adds packet-manipulation support in proxy plugins, per-interface sniffing, and Wi-Fi channel state reporting.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.41.1 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.41.1

   └──▷ TRY IT
   Capture traffic on a secondary or monitor-mode interface without changing the active session interface.
   copy

   $ set net.sniffer.interface wlan1
   net.sniffer on

   • Passes the queue handle to packet proxy plugins, enabling packet manipulation inside the callback.
   • Adds net.sniffer.interface parameter to sniff traffic from an interface different from the active one.
   • Wi-Fi module now exposes the current channel in its state output.

   3 details in Everything

4. v2.41.0 Jan 31, 2025 · release notes

   bettercap v2.41.0 adds ZeroConf/Bonjour impersonation, DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. proxy, blacklist/whitelist filtering, and scripting API expansions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.41.0 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.41.0

   • New zerogod module enables ZeroConf / Bonjour impersonation attacks on local networks.
   • api.rest now returns stdout data after executing a session command, enabling richer programmatic automation.
   • Adds addSessionEvent function to both DNS and HTTP proxy script environments for event-driven scripting.
   • Adds removeEventListener built-in function to scripting environments.
   • Implements named tickers for more precise, identifiable scheduled script execution.

   +3 more show less

   • DNS proxy gains TLS support, allowing interception and inspection of DNS-over-TLS traffic.
   • DNS proxy adds blacklist and whitelist filtering logic, including wildcard support in blacklist configurations.
   • DNS proxy supports RFC3597 generic/unknown record types when the Rdata field is present.

   8 details in Everything

5. v2.4.0 Sep 13, 2024 · release notes

   bettercap v2.4.0 adds a full CAN-bus module, wifi.bruteforce for Linux/macOS, and new GPS/history controls

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.4.0 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.4.0

   └──▷ TRY IT
   Override GPS coordinates manually (e.g. when testing location-aware caplets without a GPS receiver)
   copy

   $ sudo bettercap -eval 'gps.set 48.8566 2.3522'

   • New can module for CAN-bus recon, injection, fuzzing, filtering, and OBD-II parsing
   • Adds can.inject to inject raw CAN frames onto a bus
   • Adds can.fuzz command with optional size argument to fuzz CAN frame IDs and payloads
   • Adds can.filter to filter captured CAN traffic
   • Adds can.dup and can.dump.inject to replay frames from a candump log file

   +8 more show less

   • Adds built-in can.obd2 parser for decoding OBD-II data, including 29-bit identifiers
   • Implements wifi.bruteforce for Linux and macOS (WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 handshake attacks)
   • Adds gps.set command to manually override GPS coordinates without hardware
   • History file location is now configurable via the BETTERCAP_HISTORY environment variable
   • Embeds the web UI directly into the bettercap binary
   • Adds new WiFi RSN parsing and additional cipher suites and auth types (including WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. identification)
   • BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems., CAN, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral., and WiFi modules now set a custom shell prompt to reflect active module context
   • CAN bus state is now exposed in the session JSON object via the API

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The armhf build target has been removed and no binary is produced for it in this release.
6. v2.33.0 Aug 9, 2024 · release notes

   bettercap v2.33.0 adds NDP ban/router-lifetime controls, new scripting functions, a graph module, and updated MAC vendor data.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.33.0 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.33.0

   └──▷ TRY IT
   Set a custom router lifetime in NDP spoofing to poison IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. default gateway entries for a controlled duration.
   copy

   $ sudo bettercap -eval "set ndp.spoof.router_lifetime 0; ndp.spoof on"

   • Adds ndp.ban command to the ndp.spoof module for blocking IPv6 neighbor discovery.
   • Adds ndp.spoof.router_lifetime option to control router advertisement lifetimes during NDP spoofing.
   • Adds fileExists function to the session scripting runtime for path-existence checks in caplets.
   • Adds saveJSON function to the session scripting runtime for persisting data as JSON from scripts.
   • Adds loadJSON function to the session scripting runtime for ingesting JSON data in scripts.

   +3 more show less

   • Adds session.stopped event to the session scripting runtime for lifecycle-aware automation.
   • Introduces a new experimental graph module for visualizing network relationships.
   • Updates MAC vendor lookup database with latest IEEE datasets for more accurate OUI resolution.

   8 details in Everything

7. v2.32.0 Aug 21, 2021 · release notes

   Adds -pcap-buf-size flag, WiFi fake auth and channel hopping attacks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.32.0 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.32.0

   └──▷ USE IT
   Increase pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. buffer size to handle high-throughput capture.
   shell copy

   bettercap -pcap-buf-size 65535

   • -pcap-buf-size flag to set custom pcap buffer size
   • WiFi fake authentication attack capability
   • Channel hopping attack capability

   3 details in Everything

8. v2.31.1 May 22, 2021 · release notes

   Adds gps.new event reporting and arp.spoof.skip_restore option in v2.31.1

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.31.1 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.31.1

   • gps.new event now reports GPS data changes as they occur instead of just on initialization.
   • Adds arp.spoof.skip_restore configuration option to control ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. table restoration behavior during spoofing.

   2 details in Everything

9. v2.31.0 Apr 17, 2021 · release notes

   bettercap v2.31.0 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, wifi.probe for fake probes, ICMPv6 rogue router ads, and script require()s

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.31.0 https://github.com/bettercap/bettercap.git
   # already have the repo? check out this version:
   $ git checkout v2.31.0

   └──▷ USE IT
   Specify a custom directory for caplet files instead of the default location.
   shell copy

   bettercap -caplets-path /opt/my-caplets

   Launch a script session to inject custom JS instrumentation during runtime.
   shell copy

   bettercap -script instrument.js

   • Adds -caplets-path CLI argument to specify an alternative caplets base path.
   • New wifi.probe module to send fake client probe requests.
   • Implements ICMPv6 rogue router advertisements for IPv6 MITM scenarios.
   • net.sniff now supports IPv6 traffic inspection.
   • Basic IPv6 support enabled across the toolchain.

   +5 more show less

   • Script session allows require('file') to include other caplet scripts.
   • New -script CLI argument to run JS code for session instrumentation.
   • New gateway.change event broadcast for MITM monitoring.
   • Ticker module now broadcasts a tick event.
   • wifi.deauthentication events added for detection and parsing of deauthentication frames.

   10 details in Everything

10. v2.30 Mar 12, 2021 · release notes

    bettercap v2.30 introduces a new C2 module with SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. authentication support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.30 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.30

    • Introduces new c2 module for command-and-control communication (first draft)
    • Adds SASL authentication support to the c2 module

    2 details in Everything

11. v2.29 Jan 20, 2021 · release notes

    bettercap v2.29 adds gpsd support to the GPS module alongside existing serial connectivity

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.29 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.29

    └──▷ TRY IT
    Configure bettercap to pull GPS time/position from a local gpsd instance instead of reading a serial device directly.
    copy

    $ sudo bettercap -eval "gps.device 'udp://localhost:2947'" -eval "gps on"

    • Enables gps module to connect via gpsd daemon in addition to direct serial port

    1 detail in Everything

12. v2.28 Jul 3, 2020 · release notes

    Adds conditional logic to suppress deauth/association packets when AP key material is already acquired

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.28 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.28

    • Implemented a way to not send deauthentication and/or association packets to AP's for which key material was already acquired

    1 detail in Everything

13. v2.27 Apr 8, 2020 · release notes

    Adds http.proxy.redirect and https.proxy.redirect configs to disable iptables port redirection; displays HTTP Basic auth creds in console output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.27 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.27

    └──▷ USE IT
    Run HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxies without touching iptables rules by setting the new config keys to false.
    shell copy

    bettercap -eval "set http.proxy.redirect false; set https.proxy.redirect false; net.probe on; http.proxy on"

    • http.proxy.redirect and https.proxy.redirect config keys allow disabling iptables port redirection for the respective proxy modules
    • HTTP Basic authorization credentials are now visible in the console output when using the http-sniffer module

    2 details in Everything

14. v2.26 Oct 18, 2019 · release notes

    Adds wifi.client.probe.ap.filter and wifi.client.probe.sta.filter actions to filter wifi client probes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.26 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.26

    • wifi.client.probe.ap.filter action filters wifi client probe requests by access point

    1 detail in Everything

15. v2.25 Sep 26, 2019 · release notes

    bettercap v2.25 adds real-time WiFi TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. changes, macOS BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. support, new hid and drop callbacks, and half WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. handshake parsing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.25 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.25

    • wifi.min.rssi, wifi.ap.ttl and wifi.sta.ttl changes are now applied in realtime
    • hid.ttl parameter added
    • ble.timeout and ble.ttl parameters implemented
    • wifi.ap.ttl and wifi.sta.ttl parameters added
    • wifi.handshakes.aggregate parameter added to control how handshakes get saved

    +9 more show less

    • Reporting if wifi handshakes are full or half
    • Support for half WPA handshakes added
    • dropCallback added to drop packets instead of just changing it
    • HTTPRequest available in otto runtime
    • MENU key added to HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. generic keymap
    • ducky SLEEP command implemented in HID
    • Beacon packet included in handshake cap file for PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. assoc attack
    • Boolean flag added for dumping HTTP bodies in hex format
    • ble module now available for macOS

    14 details in Everything

16. v2.24 May 2, 2019 · release notes

    bettercap v2.24 adds mdns.server module, net.probe mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. discovery, syn.scan CHAOS banner grabbing, and tcp banner grab

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.24 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.24

    • Adds mdns.server subcommand to act as an mDNS server or spoofer
    • Enables active mDNS service discovery in net.probe module
    • Adds DNS CHAOS class banner grabbing capability to syn.scan module

    3 details in Everything

17. v2.23 Apr 17, 2019 · release notes

    bettercap v2.23 adds hardware resource export via api.rest, port service resolution in syn.scan, and enhanced req.Client data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.23 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.23

    • Exports hardware resources usage from api.rest endpoints.
    • Returns more endpoint information in the req.Client response object.

    2 details in Everything

18. v2.22 Mar 30, 2019 · release notes

    bettercap v2.22 adds API recording/replay with clock delay control and BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. HCI index configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.22 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.22

    • Adds api.rest.record, api.rest.replay API endpoints and api.rest.record.clock config key for controlled HTTP session capture and playback
    • Adds ble.device config parameter to set the specific HCI index for Bluetooth Low Energy adapters

    2 details in Everything

19. v2.21 Mar 27, 2019 · release notes

    New ui module allows installing or updating the web interface from GitHub releases.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.21 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.21

    • Adds the ui module to install/update the UI from github releases
    • Moves net.recon out of the autostarted list of modules by default

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !net.recon is no longer in the autostarted list of modules.
20. v2.20 Mar 26, 2019 · release notes

    bettercap v2.20 adds hid.clear, new /api/file route, and extensive api.rest exports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.20 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.20

    └──▷ HOW TO FIND IT
    Clear stale HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. device entries from the current session via CLI
    📍sudo bettercap -X -c 'hid.sniff on; sleep 5; hid.clear; print status'
    Write a new SSH private key file to the host filesystem via the API
    📍curl -X POST http://127.0.0.1:8080/api/file -H Content-Type: application/json -d {"path": "/tmp/id_rsa", "content": "-----BEGIN OPENSSH PRIVATE KEY-----\n..."}
    • Adds hid.clear subcommand to clear the HID device list
    • Adds /api/file API endpoint for reading and writing files via api.rest
    • Adds (http|https).proxy.whitelist and (http|https).proxy.blacklist configuration parameters for proxy traffic control
    • Adds support for wildcard domain lines in dns.spoof.hosts config key
    • Adds gzipCompress and gzipDecompress JS functions for caplets and API commands

    +3 more show less

    • Exports BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. device disconnected events, enumerated services, flags, connectable status, and module parameters via api.rest
    • Exports HID payload history (last 50 payloads), available layouts, and status via api.rest
    • Exports session polling timestamp (polled_at), network interfaces, version/OS/arch info, and caplet sub-scripts via api.rest

    8 details in Everything

21. v2.19 Mar 9, 2019 · release notes

    bettercap v2.19 adds hid.force.type for non-visible devices, -version CLI flag, events.stream.time.format, and readDir JS proxy plugin function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.19 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.19

    └──▷ USE IT
    Inject HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. keystrokes to a non-visible device by talking directly to the dongle
    shell copy

    set hid.inject 'your_script' && set hid.force.type true && run

    Check bettercap version and build info without starting an attack session
    shell copy

    bettercap -version

    Format timestamps in event streams for better log parsing or correlation
    shell copy

    set events.stream.time.format '%Y-%m-%dT%H:%M:%S' && run

    • hid.force.type parameter added to hid.inject for direct dongle communication with non-visible devices
    • -version command line argument added to print version, build information and exit
    • events.stream.time.format parameter added to configure time formatting in event streams
    • readDir function added to javascript proxy plugins for filesystem access

    4 details in Everything

22. v2.18 Mar 1, 2019 · release notes

    Adds hid.recon, hid.show, hid.sniff for MouseJack attacks and events.on/events.ignore/events.include for event-driven actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.18 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.18

    • Over the air HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. keystrokes injection (MouseJack attack) with hid.recon, hid.show and hid.sniff
    • Added events.on to trigger specific actions when an event happens
    • events.ignore and events.include now support tab completion
    • New wifi.show.manufacturer parameter to show APs manufacturers

    4 details in Everything

23. v2.17 Feb 19, 2019 · release notes

    bettercap v2.17 adds wifi.clear, ble.clear, net.clear, and new config parameters for WiFi region/txpower.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.17 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.17

    • ble.clear command to clear devices collected by ble.recon
    • net.clear command to clear endpoints collected by net.recon
    • events.filters.clear command to clear events.filters list

    3 details in Everything

24. v2.16 Feb 14, 2019 · release notes

    Adds ble.show.filter, ble.show.limit, and ble.show.sort parameters plus BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. advertisement flag parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.16

    • Adds ble.show.filter, ble.show.limit, and ble.show.sort configuration keys to control BLE device listing output.
    • Enables parsing of BLE flags and company identifiers from advertisements.

    2 details in Everything

25. v2.15 Feb 13, 2019 · release notes

    bettercap v2.15 adds RSN PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. clientless attack via wifi.assoc and RSSI filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.15 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.15

    • gateway-override command-line argument added to override the detected default gateway.
    • New arp.spoof.fullduplex parameter configures dual-sided ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. spoofing behavior.
    • New wifi.rssi.min parameter filters out Wi-Fi access points with signal strength below a threshold.
    • New net.show.meta command displays meta-information collected for one or more hosts on the network.
    • New wifi.assoc command performs an RSN PMKID clientless attack against WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 networks.

    5 details in Everything

26. v2.14 Feb 6, 2019 · release notes

    bettercap v2.14 adds WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. handshake capture and opens http.server/https.server for parallel use

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.14 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.14

    └──▷ HOW TO FIND IT
    Capture a WPA handshake from any connected client for offline password cracking
    📍wifi.recon on wifi.show
    Deauth clients on closed networks only, ignoring open access points
    📍set wifi.deauth.open true deploy wifi.deauth ff:ff:ff:ff:ff:ff
    Run both HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. servers simultaneously in one bettercap session
    📍set http.server.port 80 set https.server.port 443 start http.server start https.server
    • wifi.recon now intercepts, parses, and dumps full WPA 4-way handshakes to file automatically
    • wifi.deauth.open boolean parameter skips open networks during mass deauthentication
    • Splits http.server and https.server into separate modules for simultaneous use in one instance

    3 details in Everything

27. v2.13.1 Jan 29, 2019 · release notes

    bettercap v2.13.1 adds teamviewer and FTP credential parsing to net.sniff.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.13.1 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.13.1

    • Adds teamviewer packet parser for net.sniff
    • Adds net.sniff FTP credentials parser

    2 details in Everything

28. v2.13 Jan 28, 2019 · release notes

    bettercap v2.13 adds net.fuzz module, WPS parsing, and filter/sort parameters for wifi/net.show

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.13 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.13

    • Introduces the net.fuzz network fuzzer module
    • Adds wifi.show.wps command for WPS parsing capabilities
    • Adds wifi.show.filter, wifi.show.limit and wifi.show.sort parameters to control wifi.show output
    • Adds net.show.filter, net.show.limit and net.show.sort parameters to control net.show output

    4 details in Everything

29. v2.12 Jan 20, 2019 · release notes

    bettercap v2.12 adds syn.scan stop command and wifi.deauth.skip variable.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.12 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.12

    └──▷ TRY IT
    Stop a running SYN scan that is taking too long.
    copy

    $ syn.scan stop

    Configure bettercap to silence deauthentication traffic while keeping the capability active.
    copy

    $ set wifi.deauth.silent true

    Monitor SYN scan progress every 5 seconds using the new variable.
    copy

    $ set syn.scan.show-progress-every 5

    • wifi.show now outputs interface name and current channel alongside existing data.
    • wifi.show displays I/O statistics similar to net.show.
    • Adds the wifi.deauth.silent variable.
    • New syn.scan stop command for halting scans (closes #415).
    • New syn.scan.progress command and syn.scan.show-progress-every variable for scan monitoring (ref #415).

    5 details in Everything

30. v2.11 Nov 19, 2018 · release notes

    bettercap v2.11 adds log rotation, 5G WiFi support on macOS, and filtered output for net.show

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.11 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.11

    • Added logrotate configuration option to enable automatic log file rotation
    • WiFi modules now detect and interact with 5G WiFi networks on macOS
    • net.show command now accepts a comma-separated list of IPs, MACs, or aliases to filter output
    • Added debug callback interface to the network package for custom logging hooks

    4 details in Everything

31. v2.10 Oct 4, 2018 · release notes

    bettercap v2.10 adds caplets module, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. session status endpoint, and new event stream config options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.10 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.10

    └──▷ TRY IT
    Disable HTTP dump events for request and response streams to reduce verbosity.
    copy

    $ set events.stream.http.request.dump false; set events.stream.http.response.dump false

    • Adds /api/session/modules route exposing modules realtime status from the rest api
    • Adds caplets module to manage system caplets
    • Adds events.stream.http.request.dump and events.stream.http.response.dump parameters to enable or disable http dumps
    • Adds api.rest.alloworigin parameter to customize the Access-Control-Allow-Origin header of the api server.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !api.rest is now on http and port 8081 by default
32. v2.9 Sep 11, 2018 · release notes

    bettercap v2.9 adds WSD/UPNP/NBNS/MDNSMDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. discovery agents, systemd service for API server, and selective probe control flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.9

    └──▷ TRY IT
    Probe a network using only NBNS and MDNS, excluding WSD and UPNP agents.
    copy

    $ net.probe +agents.nbns +agents.mdns -agents.wsd -agents.upnp

    Run bettercap as a background system service exposing the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    copy

    $ sudo systemctl enable bettercap-api.service
    sudo systemctl start bettercap-api.service

    Filter net.show output to display only details for a specific IP address.
    copy

    $ net.show 192.168.1.105

    • net.probe now uses WSD, UPNP, NBNS, and MDNS discovery agents to fetch endpoint metadata
    • New boolean parameters allow selectively enabling or disabling specific net.probe probe agents
    • New net.show.meta boolean flag enables or disables endpoint metainfo rendering
    • systemd service file provided to run bettercap as a system api.rest server
    • api.rest disables authentication if username or password are empty

    +3 more show less

    • api.rest switches to HTTP if provided key and certificate paths are empty
    • net.sniff now reports mDNS queries
    • net.probe uses both NBNS and MDNS queries to fetch endpoints metadata and hostnames

    8 details in Everything

33. v2.8 Aug 17, 2018 · release notes

    bettercap v2.8 adds any.proxy module, JS injection params, and custom HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cert fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.8

    └──▷ HOW TO FIND IT
    Redirect traffic to an external proxy using the new module.
    📍set any.proxy.host <external-proxy-host>; set any.proxy.port <port>; run any.proxy
    Inject JavaScript into HTTPS traffic without running a full proxy chain.
    📍set https.proxy.injectjs /path/to/script.js; run https.proxy
    Configure a custom HTTPS certificate for the built-in server.
    📍set http.server.cert_path /path/to/cert.pem; set http.server.key_path /path/to/key.pem; run http.server
    • Adds any.proxy module to redirect traffic to custom proxy tools
    • Implements http.proxy.injectjs and https.proxy.injectjs parameters to inject javascript code, files or URLs without a proxy module
    • Enables customization of single https certificate / authority fields via dedicated module parameters (http.server, https.proxy, api.rest)
    • Adds /usr/share/bettercap/caplets/ as one of the default search paths for .cap files

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The data field and the return value of the onData callback for the tcp.proxy are now byte arrays instead of strings (fixes #284)
34. v2.7 Jul 23, 2018 · release notes

    bettercap v2.7 adds env variable expansion in commands and broadcast BSSID deauth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.7

    └──▷ TRY IT
    Deauth all clients across all SSIDs in the area using a broadcast BSSID.
    copy

    $ wifi.deauth ff:ff:ff:ff:ff:ff

    Access an environment variable within a bettercap command using the new expansion syntax.
    copy

    $ set some.option "{env.MY_VAR}"

    Use the new API method in a Go module that imports bettercap to clear HTTP response bodies.
    go copy

    JSResponse.ClearBody()

    • wifi.deauth now accepts a broadcast BSSID to deauth all clients from every access point.
    • Variables are accessible from every command via {env.varname} syntax.
    • JSResponse.ClearBody API is implemented.

    3 details in Everything

35. v2.6 May 12, 2018 · release notes

    bettercap v2.6 adds arp.spoof.internal param and tcp.tunnel tunneling support in tcp.proxy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.6

    • Adds arp.spoof.internal boolean parameter to control internal ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. spoofing behavior
    • Implements new tcp.tunnel parameter for the tcp.proxy module to enable tunneling

    2 details in Everything

36. v2.5 Apr 23, 2018 · release notes

    Bettercap v2.5 adds rogue MySQL server, read session command, and dns.spoof wildcards

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.5

    • Implemented new mysql.server module for rogue MySQL server simulations.
    • Added read session command to capture user input into variables.
    • Added wildcard expression support in the dns.spoof module.

    3 details in Everything

37. v2.4 Mar 29, 2018 · release notes

    BetterCap v2.4 adds a Linux NFQUEUE packet proxy module and allows caplets to run as interactive session commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.4

    • Adds arp.spoof.whitelist variable supporting macs, ips, ip ranges and aliases

    1 detail in Everything

38. v2.3 Mar 20, 2018 · release notes

    Adds update.check and wifi.ap modules, onCommand callbacks for HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxies, writeFile builtin, request/response Header methods, Log levels in http.modules, optional start port for syn.scan

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.3

    • Adds the update.check module to enable self-update capability
    • Introduces the wifi.ap module for wireless access point operations
    • Enables onCommand callbacks in http.proxy and https.proxy modules to handle custom session commands
    • Adds the writeFile(path, data) function within proxy modules for writing data to files
    • Provides Log levels and base64 dec/enc capabilities as new builtins in http.modules

    +2 more show less

    • Implements request.Header and response.Header methods for HTTP proxy modules to access headers
    • Makes the start port optional in syn.scan, defaulting to port range 1-65535

    7 details in Everything

39. v2.2 Mar 13, 2018 · release notes

    bettercap v2.2 adds -no-colors, events.stream.output, offline wifi pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. recon and sslstrip

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.2

    └──▷ USE IT
    Run bettercap in CI or logs where ANSI color codes cause formatting issues.
    shell copy

    bettercap -no-colors

    • Adds the -no-colors CLI argument to disable terminal coloring.
    • Introduces the events.stream.output configuration setting for controlling event stream output.
    • Implements basic SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS stripping functionality (sslstrip).
    • Enables the wifi module to perform offline reconnaissance using a pcap file as input.

    4 details in Everything

40. v2.1 Mar 6, 2018 · release notes

    Adds gps module, optional websocket for /api/events, and wildcard support in get command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1 https://github.com/bettercap/bettercap.git
    # already have the repo? check out this version:
    $ git checkout v2.1

    └──▷ TRY IT
    Retrieve all variables starting with api using the new wildcard syntax.
    copy

    $ get api*

    • Adds the gps module for location tracking.
    • Implements optional websocket protocol for /api/events.
    • Allows modification of request objects within OnRequest handlers.

    3 details in Everything