Bettercap : MITM attack for sniffing traffic and passwords

By ujjawal kumar singh bettercap, kali, mitm, outlook, password, ruby, sniffing

  • Disclaimer – TLDR; some stuff here can be used to carry out illegal activity, intention is, however, to educate

Contents

  • Installation
  • Sniffing Traffic
  • Getting password
We will be installing Bettercap, doing a quick sniffing exercise, and then a more detailed section on grabbing the password. Will demonstrate the password grabbing on outlook.com, which seems to be particularly vulnerable to this attack.

Installing bettercap

Installation is simple-

apt-get update

apt-get dist-upgrade

apt-get install bettercap

The above three commands will leave you with latest versions of Kali and bettercap.

I am writing this tutorial from a location with slow internet connection, and hence didn’t perform the dist-upgrade step. However, bettercap seems to be running mostly fine. There may be a few difference in what you observe and what I show in this demo due to this difference in versions. For those who want to know the versions of various utilities that I’m using, take a look below. If you are unfamiliar with Linux, you’re best off using the latest versions of everything, which can be obtained by running the three commands I mentioned earlier.

new@kali:~$ uname -a
Linux kali 4.7.0-kali1-amd64 #1 SMP Debian 4.7.6-1kali1 (2016-10-17) x86_64 GNU/Linux

new@kali:~$ bettercap -v
bettercap 1.5.8
new@kali:~$ ruby -v
ruby 2.3.1p112 (2016-04-26) [x86_64-linux-gnu]

Sniffing Traffic

There’s nothing special about the usual sniffing traffic functionailty of bettercap. Bettercap can easily performing sniffing on your local area network. It also lets you write the output to a pcap file and later analyze it with WireShark or some other tool of your choice. I’ll just give a simple demo here. The real fun is in the capturing passwords section.
Run the command-

bettercap –sniffer

You’ll see all the websites being visited by all the devices on the network. Press ctrl+c to stop.

Capturing passwords

The fun part lies here. Bettercap uses sslstrip to change https webpages to simple http ones, which ensures that the passwords are transferred in clear text, and you can read them without any issues. I will be targeting my  phone from my Kali machine. First, you must find the IP of your target. This can be done by simply running bettercap and waiting for all machines on your network to show up. Once they do, you can identify the one you’re trying to attack, and note it’s IP. Then use this IP as the target IP. Let’s look at the steps first.
 I’m assuming you connected to the network you are attacking using the wlan0 interface. If not, specify your interface using the -I option.
  1. Run the command bettercap on the terminal
  2. Wait for bettercap to acquire targets.
  3. When bettercap discovers the target you’re looking for, note down it’s IP address. Let’s call it TARGET_IP.
  4. Press ctrl+c to stop bettercap (if internet connectivity is lost, as was in my case, restart your wlan0 interface)
  5. Run this command – bettercap -T TARGET_IP –proxy -P POST (replace TARGET_IP with the appropriate IP)
In  my case, my target was my  smartphone. It was detected by bettercap,

and i noted down it’s IP. 192.162.2.2 is what I’ll use as my TARGET_IP

Now your attacker machine is ready and listening for traffic on the network. Once your victim opens any login page, bettercap will use sslstrip to remove the https from the URL, and once the target enters his/her login credentials, you will see them in cleartext.

Let’s look at a demo run of the above procedure.

Capturing passwords entered on Outlook by smartphone user on same LAN/WLAN

This section is simply going to be a set of pictures with captions below them explaining stuff. It should be easy to follow I hope.
Starting bettercap using the command I specified earlier.
Then I proceed to open outlook.com on my smartphone
SSLStrip detects that I’m trying to access outlook, removes the https from the page
This is the login page that my smartphone sees. Notice the address in the URL.
This is what the address should look like, with HTTPS. The URL on the smartphone lacks
HTTPS, and has extra Ws in www. I enter the username here. Meanwhile,
bettercap detected that username was entered and shows that to me.
Bettercap shows me the username. In the smartphone, I am at the password stage after entering username.
I now enter the password. Let’s see what happens on the attacker machine
I entered the password as “wrongpass” on my smartphone, and
bettercap is able to detect it.