There are many tools out there for Wi-Fi hacking, but few are as integrated and well-rounded as Bettercap. Thanks to an impressively simple interface that works even over SSH, it's easy to access many of the most powerful Wi-Fi attacks available from anywhere. To capture handshakes from both attended and unattended Wi-Fi networks, we'll use two of Bettercap's modules to help us search for weak Wi-Fi passwords.
Wi-Fi Hacking Frameworks
The idea of organizing tools into useful frameworks isn't new, but there are many ways of doing it. Frameworks like Airgeddon include an incredible amount of bleeding-edge Wi-Fi hacking tools but cannot be used over a command line. That's because Airgeddon requires the ability to open new windows for different tools to run, so if you're communicating with a Raspberry Pi over SSH, you can forget launching many Wi-Fi hacking tools.
Bettercap allows access to the tools needed to swiftly scout for targets, designate one, and grab a WPA handshake to brute-force. While we won't be working with any WPS recon modules today, our setup will allow you to audit for weak WPA passwords with ease. The way Bettercap is organized allows for anyone within proximity of a target to probe for weak WPA passwords while staying stealthy and undetected.
WPA Hacking with Bettercap
Bettercap is described as the Swiss Army knife of wireless hacking. To that end, it has a lot of modules for sniffing networks after you connect to them, as well as other modules looking at Bluetooth devices. The most straightforward use of Bettercap is to use the scanning and recon modules to identify nearby targets to direct attacks at, then attempt to identify networks with weak passwords after capturing the necessary information.
Our targets, in this case, will be two kinds of networks: attended and unattended. Attended networks are easier to attack, and a larger number of tools will work against them. With an attended network, there are people actively using it to download files, watch Netflix, or browse the internet. We can count on there being devices to kick off the network that will give us the information we need to try to crack the password.
Unattended networks are trickier to target. Because they do not have devices with an active data connection on them to disconnect, these networks were typically unable to yield the information needed to audit for a weak password. With the PMKID approach to cracking WPA passwords, that's no longer the case. The tool is integrated as one of the Wi-Fi hacking modules and makes it even easier to attack.
Brute-Forcing Power Workarounds
Bettercap doesn't directly break the passwords of networks it targets, but it would be impossible to do so without the information Bettercap provides. Once a handshake is captured, you'll need to use a brute-forcing tool like Hydra or Aircrack-ng to try a list of common passwords against the hash you've captured. How quickly it will happen depends on a few factors.
The first is whether the password used to secure the target network is in the password list you're using at all. If it isn't, this attack won't succeed, so it's essential to use lists of real stolen passwords or customized password generators like CUPP. If you don't believe that brute-force attacks are still effective, you'd be surprised to learn that any eight-character password can be brute-forced in a little over two hours.
Another workaround to using a device like a Raspberry Pi for Wi-Fi hacking is to upload the WPA handshake to a cracking service or network. Many hackers use networks that distribute the cracking load among volunteer "worker" computers, which lets the group crack WPA handshakes that less powerful devices can gather.
If you were to run Bettercap on a Raspberry Pi and then upload the captured handshakes to a distributed WPA cracker, you would be able to crack passwords within mere minutes. Alternatively, you could set this up yourself if you have a computer with a powerful processor and GPU.
What You'll Need
To follow this guide, you'll need a wireless network card you can put into wireless monitor mode. You can find a list of these in our previous articles on buying Wi-Fi network adapters. Your computer may have an internal card that supports wireless monitor mode, but you'll need to be running Linux to work with it. You can refer to our other guide to find out if your existing card will work.
You can follow our guide today with Kali Linux on your laptop, a Raspberry Pi running Kali Linux, or even Ubuntu with some additional installation. For best results, you should use Kali Linux, because Bettercap comes preinstalled.
Step 1Install Bettercap
If you have Kali Linux installed, you can find it in the "Sniffing & Spoofing" folder in the "Applications" menu or from a search.
If you don't have Bettercap, the documentation for the project is on the Bettercap website. If you're running Kali, you can run apt install bettercap to add it, as seen below. Then, you can locate the tool as seen above.
If you're not running Kali, you'll need to refer to Bettercap's more complicated setup. If you're on a Mac, you can do network recon, but the modules I'm writing about won't work. Still, you can check out other features by installing it with Homebrew, using the command brew install bettercap.
Step 2Launch Bettercap
When ready, click on Bettercap's icon to launch it. You should see the following help menu in a terminal window, although the tool will not automatically start.
Here, we can see the arguments we can start Bettercap with. One of the most useful of these is -iface which allows us to define which interface to work with. If we have an external wireless network adapter, we'll need to define it with that.
Step 3Connect Your Network Adapter & Start
Now, we'll need to put our card into monitor mode. If we're connected to a Wi-Fi network already, Bettercap will start sniffing that network instead, so monitor mode always comes first.
Locate your card with ifconfig or ip a to find the name of your network adapter. It should be something like wlan0 for your internal adapter and wlan1 for your USB network adapter.
Take the adapter that's monitor mode-compatible, and switch it to monitor mode by opening a terminal window and typing airmon-ng start wlan1, with wlan1 substituted with the name of your network adapter.
You can then type ifconfig or ip a again to verify it started.
After making sure that your wireless card is in monitor mode, you can start Bettercap by typing sudo bettercap --iface wlan1mon in a new terminal window, substituting the "wlan1" portion with your card's name.
Once Bettercap opens, type help to see a list of all the modules running and commands. In the modules, you can see that the Wi-Fi module is not started by default.
Step 4Scan for Nearby Networks
To get started, let's look at the commands we can issue under the Wi-Fi module. We can see this information by typing help wifi into Bettercap.
Here, we can see lots of options! For our purposes, we'll be selecting the Wi-Fi recon module. To start it, type wifi.recon on into Bettercap. You'll begin to get a flood of messages as soon as networks start to be detected. If this gets overwhelming, you can type events.stream off to mute the alerts.
Step 5Identify Targets
To see the networks that have been detected, type wifi.show to display a list of networks.
Wow, we can see tons of information about the nearby wireless environment around us, such as which networks are strongest and what kinds of encryption they use.
You'll notice that all of the networks will be in green (you can't see it in this article, but on yours, you will see green). When we see a network is red (again, not in the box above but you will see it on your end), it means we have a handshake for it and can attempt to brute-force it. Let's start with a tried-and-true method first, and use the deauth module to try to get handshakes.
Step 6Attack with a Deauth Attack
To start the deauth module, you'll type wifi.deauth and then the MAC address of the network you want to attack. If you want to attack every network you've found, you can just type all or *, but be aware this can be illegal if you're interfering with someone's Wi-Fi that did not permit you to test this tool on it.
After allowing the tool to run for a minute or so, we can see the results by typing wifi.show and seeing if any results have come in red. In our example, we can see that we've managed to grab handshakes for three of the nearby Wi-Fi networks we've detected.
This is a good result, but many of these networks are not attended, as can be seen by the client count section. Notice how this method didn't work against any network that didn't have clients attached? To attack these unattended networks, we'll need to run the second module. To save any handshakes captured, use set wifi.handshake followed by the directory you want to save the file in.
Step 7Attack with a PMKID Attack
To begin our attack against unattended networks, we'll type wifi.assoc and then the MAC address that we want to attack. If we're going to attack all networks we've detected, typing all or * instead will do so. If you enabled events.stream off but want to see the results of this module roll in, you can reenable the event stream by typing events.stream on and watching for results that look like the following.
Now that we've tried both tools, let's take a look at our results with wifi.show. We should, if we're lucky, see more networks in red. While there are no colors below, five of them were indeed red.
By running both modules, we were able to grab the information we need for five out of the ten closest Wi-Fi networks. That's pretty impressive. If we open the file Bettercap generated from these captures, we can see the information Bettercap has saved for us to crack in another program.
There we go! With Bettercap, we can capture the signals we need from Wi-Fi networks to brute-force weak passwords. now you can brute force the file.
Bettercap Is the Swiss Army Knife of Wi-Fi Hacking
Bettercap is an essential part of any hacker's toolkit, especially for the ability to run smoothly on low-cost devices like a Raspberry Pi. With Bettercap's ability to quickly discover low-hanging fruit like weak network passwords, you can use it to gain further access to devices on a network through ARP spoofing and poisoning in other Bettercap modules.
Make sure only to use the active modules of Bettercap on networks you have permission to use, but the recon modules are fine to use virtually anywhere. With enough patience, Bettercap will simply record handshakes when users connect to the network naturally, without needing to attack the network at all.