With this script you can host an access point with create_ap by @oblique and sniff all traffic with Bettercap automatically. If you are connected to an existing network and want to sniff some traffic there, you can do that too.
Features
- Sniff domains your victim is visiting/pinging (full path location if request is not encrypted with SSL/TLS)
- Sniff unencrypted credentials from sources like telnet, SMTP or FTP
- Inject customizable javascript into every http website
- Sniffed traffic will be logged for later analysis
- Probe-request scanner (only rogue AP mode)
- Create configurable AP (only rogue AP mode)
- ARP-spoofing for beeing the mitm (only client mode)
Installation
For me it works like a charm on kali (all needed tools are preinstalled). If you want to run it for example on a raspberry pi with a debian based system, it should work too. Now the installation guide:
git clone https://github.com/90N45-d3v/BetterSniff.git
cd BetterSniff
sudo bash requirements.sh
# and run it!
sudo bash BetterSniff.sh
Analyze your traffic later
If you sniffed some traffic with BetterSniff once, there will be a loot file (loot.pcap) for later analysis. You can take a look at the sniffed traffic with following commands:
# start bettercap
sudo bettercap
# set loot.pcap as source for net.sniff
set net.sniff.source loot.pcap
# take a look at it
net.sniff on
Working on...
- New mode: EvilTwin (clone existing WPA2-AP)
- Settings for easily handling the mapping of domains to a custom IP address (Bettercap's DNS spoofer)
- deauth for more probe-requests (only rogue AP mode)
Some information
I know, that this code could be better. If you have some improvements, errors or other things to say, just make a fork, pull-request, open an issue or contact me on twitter @90N45.