Session hijacking cheat sheet

Bettercap

Using Bettercap to collects all http logins used by routers, servers, and websites that do not have SSL enabled

-iface: Specifies the interface to bind to.

This module will send different types of probe packets to each IP in the current subnet for the net.recon module to detect them.

The net.recon module displays the detected active IP addresses in the network. In real-time, this module will start sniffing network packets.

This module enables SSL stripping.

This module spoofs the local connections among computers of the internal network.

This module spoofs the IP address of the target host.

This module initiates http proxy.

This module initiates arp spoofing.

This module is responsible for performing sniffing on the network.

This module will only consider the packets sent with a payload matching the given regular expression (in this case, ‘.*password=.+’).

Using Bettercap to sniff network traffic from https-based websites

set http.proxy.sslstrip true