macOS
Homebrewverified · 100%
brew install bettercaplocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install bettercapMacPorts ports tree · net/bettercap/Portfile · source: api.github.com
brew
Install bettercap with Homebrew, apk, apt, MacPorts, Nix, pacman, zypper
Swiss army knife for network attacks and monitoring. Version 2.41.7 via Homebrew; verified 2026-05-11.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add bettercapAlpine Linux edge package indexes · bettercap · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install bettercapDebian stable package indexes · bettercap · source: deb.debian.org
Nixverified · 92%
nix profile install nixpkgs#bettercapnixpkgs package indexes · pkgs/by-name/be/bettercap/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S bettercapArch Linux sync databases · bettercap · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install bettercapopenSUSE Tumbleweed package metadata · bettercap · source: download.opensuse.org
overview
Package summary
Swiss army knife for network attacks and monitoring
Project links
Commands and aliases
- bettercap
history
Project history and usage
bettercap is a Go-based network reconnaissance and attack framework packaged as a command-line tool for security researchers, red teamers, and reverse engineers. Its official description frames it as an all-in-one toolkit for Wi-Fi, Bluetooth Low Energy, HID, CAN-bus, IPv4, and IPv6 reconnaissance and MITM work.
Project history
The current public repository was created in January 2018 and hosts the Go implementation, documentation links, caplets, modules, tests, and release automation for bettercap 2.x. The project replaced the older single-purpose idea of a LAN MITM helper with a modular framework covering wireless and wired network attack surfaces.
Official release tags show the 2.x line continuing through regular maintenance and feature releases, including v2.40.0 in September 2024, v2.41.0 in January 2025, and v2.41.7 in May 2026.
Adoption history
bettercap became a common package-manager install for offensive-security labs because it combines sniffing, spoofing, Wi-Fi handshakes, BLE enumeration, packet/protocol proxies, and a REST/web UI under one executable. Homebrew, Debian/Ubuntu, Arch, Alpine, Nix, MacPorts, and openSUSE packaging in the input reflects that cross-platform adoption.
The GitHub repository's large star and fork counts, Docker image badge, and active release stream indicate that bettercap is used beyond macOS packaging: it is a standard tool people expect to be available in disposable lab machines, containers, and security-focused Unix environments.
How it is used
Users typically run bettercap interactively or with caplets to discover hosts, inspect traffic, run spoofers, capture Wi-Fi handshakes, enumerate BLE devices, or script network experiments. Its official docs emphasize an interactive session workflow and module-driven operation rather than a single fire-and-forget scan command.
Because the tool performs real attack and monitoring functions, its practical use belongs in authorized security testing, lab networks, red-team exercises, and research settings.
Why package nerds care
bettercap is package-nerd interesting because it is one of the few security CLI packages that collapses many historically separate tools into one Go binary with modules, a web UI, REST API, caplets, and packaged defaults. It sits at the intersection of classic Unix networking tools, wireless security suites, and modern self-contained Go distribution.
For Homebrew-style package history, bettercap also illustrates how offensive-security tooling moved from language/runtime-heavy installs toward portable binaries that can be installed quickly on a laptop, container, or lab host and then extended with scripts and modules.
Timeline
- 2018: Current bettercap/bettercap GitHub repository created for the Go-based 2.x project.
- 2024: v2.40.0 released, showing the mature 2.x line still receiving updates.
- 2025: v2.41.0 released.
- 2026: v2.41.7 published in May, with repository activity continuing in June.
Related projects
- Related tools include Wireshark and tcpdump for packet inspection, aircrack-ng for Wi-Fi security workflows, mitmproxy for programmable proxying, nmap for network discovery, and ettercap as an older MITM-oriented tool whose niche bettercap partly modernized.
Sources
security posture
Risk level: red
network interception and offensive security tool.
Risk classifier
red risk · high confidence · escape-surveillance-offensive
Why
- network interception and offensive security tool
Signals
- override:bettercap
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 1 runtime dependencies.
- Build metadata lists 2 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
~/bettercap.env
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
bettercap | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version2.41.7
manager updated2026-05-11
local dataok
upstreamcurrent
latest detectedv2.41.7
https://github.com/bettercap/bettercap
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:bettercap |
|---|---|
| Version | 2.41.7 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/bettercap |
| Homepage | https://www.bettercap.org/ |
| Repository | https://github.com/bettercap/bettercap |
| Upstream docs | https://www.bettercap.org/ |
| License | GPL-3.0-only |
| Source archive | https://github.com/bettercap/bettercap/archive/refs/tags/v2.41.7.tar.gz |
| Last updated | 2026-05-11T13:17:23Z |
| Pulse | updated |
| Dependencies | libusb |
| Build dependencies | go, pkgconf |
| Uses from macOS | libpcap |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
| Caveats | bettercap requires root privileges so you will need to run `sudo bettercap`. You should be certain that you trust any software you grant root privileges. |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | bettercap |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
bettercap 2.33.0-1+b9
Complete, modular, portable and easily extensible MITM framework
sudo apt install bettercap- Section: net
- Architecture: amd64
- Source Package: bettercap
- 8 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Bettercap
Nix95%
bettercap
nix profile install nixpkgs#bettercap- normalized package name match
- Matched by: Bettercap
Ubuntu apt95%
bettercap 2.32.0-2build3
Complete, modular, portable and easily extensible MITM framework
sudo apt install bettercap- Section: universe/net
- Architecture: amd64
- 8 dependencies
- normalized package name match
- Matched by: Bettercap
apk95%
bettercap 2.41.7-r0
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
sudo apk add bettercap- License: GPL-3.0-or-later
- Architecture: x86_64
- Source Package: bettercap
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Bettercap
apk95%
bettercap-doc 2.41.7-r0
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks. (documentation)
sudo apk add bettercap-doc- License: GPL-3.0-or-later
- Architecture: x86_64
- Source Package: bettercap
- normalized package name match
- Matched by: Bettercap
pacman95%
bettercap 2.41.7-1
Swiss army knife for network attacks and monitoring
https://github.com/bettercap/bettercap
sudo pacman -S bettercap- License: GPL-3.0-only
- Architecture: x86_64
- 8 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Bettercap
zypper95%
bettercap 2.41.7-1.1
Swiss army knife for network attacks and monitoring
sudo zypper install bettercap- License: GPL-3.0-or-later
- Category: Productivity/Networking/Diagnostic
- Architecture: x86_64
- Source Package: bettercap
- 3 dependencies
- 1 provides
- normalized package name match
- Matched by: Bettercap
MacPorts95%
bettercap
sudo port install bettercap- normalized package name match
- Matched by: Bettercap
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment