I was wondering how I could sniff HTTPS credentials using the Bettercap proxy.

I am using the following command:

bettercap -I wlan0 -T -X  --proxy-https

And when I setup the proxy on my android (In WiFi settings), with the address as, I can see when the phone authenticates with my WiFi.

HOWEVER, I can't see any credentials showing up when I log into FaceBook, Instagram etc. In fact, there isn't anything on the terminal except when my device connects to my WiFi.

Am I missing a command line argument?

  • Have you tried to fake a login request to a non HSTS enabled website? Jan 30, 2018 at 8:29

1 Answer 1


Bettercap tool using HSTS technique to bypass https sites, and this type of attack work only for sites not listed on the preloaded list.

You can check the list here.

If you are trying to sniff the traffic of facebook or google apps( such as Gmail, Instagram,...) it's didn't work, even if the client uses the application or the browser, because of the preloaded list listed on the browser, and the certificate embedded in the applications.

Try to open facebook on internet explorer, it will work fine because IE browser does not use preloaded list.

You can create an https proxy with SSL root certificate and install this certificate to your phone, then you can decrypt HTTPS traffic.


  • Thanks for your answer! Your English makes this post hard to understand, though; particularly the first sentence. I assume you mean that HSTS prevents bettercap, not that betterap uses HSTS?
    – Luc
    Jun 14, 2018 at 5:31
  • @Luc yes bettercap support SSLstrip+ that Partially bypass HSTS
    – androux
    Jun 14, 2018 at 8:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .