Bettercap is a complete, modular, portable and easily extensible tools and framework for MITM with diagnostic and offensive functions of all street, you may need to perform the attack man in the middle.
Is there a complete, modular, portable and easy to extend the tool to MITM attack? If your answer is “ettercap”, let's take a closer look:

• ettercap has been a great tool, but its time has passed.
• ettercap filters do not work in most cases, are outdated and difficult to implemented due to the peculiarities of the language in which they are implemented.
• ettercap damn unstable for large networks ... try to run host discovery on large networks — larger than normal /24
• Yes, you might see the connection and the raw material pcap, Yes, a great toy, but as a professional researcher you want to see only relevant material.
• if you are not a developer in C/C++, you can easily expand ettercap or make your own module.

In fact, you could use more than one instrument ... maybe arpspoof to direct poisoning (poisoning), mitmproxy for intercepting HTTP material and introduction to your payload, etc ... I don't know about you, but the author bettercap hates when he has to use a lot of tools just to perform a single attack, especially when they all need to work in unison on one distributive because it violates the KISS principle. (Wikipedia).

Features bettercap

• Dynamic host discovery + ARP Spoofing

You can target the entire network or at a single known address, it doesn't matter, functions bettercap on arp spoofing and its agent to detect several hosts will do the dirty work. Just run the tool and wait while it does its job ... and, of course, new cars that appeared in the network will be detected automatically and propolene. If your router has a built-in protection against ARP spoofing, don't worry, you can fight it in half-duplex mode

• Sniffer credentials

The built-in sniffer now able to analyze and print the following information:

• visited URLS.
• visited HTTPS hosts.
• sent by the HTTP POST data.
• HTTP Basic and Digest authentications.
• FTP credentials.
• IRC credentials.
• credentials POP, IMAP, and SMTP.
• credentials NTLMv1/v2 ( HTTP, SMB, LDAP, etc.).

How to install Bettercap

BetterCap comes packaged as a Ruby gem, meaning you will need a Ruby interpreter ( >= 1.9 ) and a RubyGems environment installed.

You can easily install bettercap using the gem install GEMNAME command:

• gem install bettercap

To update to a newer release:

• gem update bettercap

If you have trouble installing bettercap read the following sections about dependencies.

    If you installed bettercap using a RVM installation, you will need to execute it using rvmsudo:

    rvmsudo bettercap ...

    Otherwise, if you installed it globally ( sudo gem install bettercap ) you can use sudo:

    sudo bettercap ...

All dependencies will be automatically installed through the GEM system, in some cases you might need to install some native dependency in order to make everything work:

• sudo apt-get install ruby-dev libpcap-dev

Once you've installed bettercap, quickly get started with:

• bettercap --help

Usage Examples

    Default sniffer mode, all parsers enabled:

sudo bettercap -X

    Enable sniffer and load only specified parsers:

sudo bettercap -X -P "FTP,HTTPAUTH,MAIL,NTLMSS"

    Enable sniffer and use a custom expression:

sudo bettercap -X --custom-parser "password"

    Enable sniffer + all parsers and parse local traffic as well:

sudo bettercap -X -L

    Enable sniffer + all parsers and also dump everything to a pcap file:

sudo bettercap --sniffer --sniffer-pcap=output.pcap

    What about saving only HTTP traffic to that pcap file?

sudo bettercap --sniffer --sniffer-pcap=http.pcap --sniffer-filter "tcp and dst port 80"

    Default ARP spoofing mode on the whole network without sniffing:

sudo bettercap

    Use an ICMP Redirect spoofer ( instead of the ARP spoofer ) on the whole network:

sudo bettercap -S ICMP    

    Spoof the whole network in half-duplex mode:

sudo bettercap --half-duplex

    Only spoof specific targets:

sudo bettercap -T 192.168.1.10,192.168.1.11

    Only spoof a specific target by its MAC address:

sudo bettercap -T 01:23:45:67:89:10

    Spoof the whole network but **ignore** some addresses:

sudo bettercap --ignore 192.168.1.10,192.168.1.11

    Spoof a target and kill its connections:

sudo bettercap -T 192.168.1.10 --kill

    Spoof the whole network and keep automatically searching for new hosts **without** resolving their hostnames:

sudo bettercap --no-target-nbns

    Spoof the whole network without performing dynamic host discovery:

sudo bettercap --no-discovery

    Enable proxy on default ( 8080 ) port with no modules ( quite useless ):

sudo bettercap --proxy

    Enable proxy and use a custom port:

sudo bettercap --proxy --proxy-port=8081

    Enable proxy and load the module **hack_title.rb**:

sudo bettercap --proxy --proxy-module=hack_title.rb

    Disable spoofer and enable proxy ( stand alone proxy mode ):

sudo bettercap --no-spoofing --no-discovery --proxy

    Enable HTTPS proxy with realtime crafted certificate:

sudo bettercap --proxy-https

    Enable HTTPS proxy with custom .pem certificate:

sudo bettercap --proxy-https --proxy-pem ./mycert.pem

    Use a custom upstream proxy already running on your machine for both HTTP and HTTPS requests:

sudo bettercap --custom-proxy 192.168.1.2 --custom-https-proxy 192.168.1.2