Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser?

With no proxy configured it is working fine. But as soon as a proxy is set in the browser connection settings, bettercap is unable to see traffic. I guess this is normal since with proxy traffic is going to the proxy server rather than the gateway.

Is it possible in such a setup to intercept traffic with bettercap? Is there any other way to achieve the same without bettercap?

bettercap -T --proxy -P POST 
  • User IP:, G/w
  • Proxy Server IP:
  • Kali Linux (running bettercap):, G/w

My question is more towards topological scenario..and how to overcome that.? Bettercap is working perfectly.

I'm using this command.

bettercap -T x.x.x.x --proxy -P

and getting this output

[E] You're using bettercap as a normal HTTP(S) proxy, it wasn't designed to handle CONNECT requests:

CONNECT sam.msn.com:443 HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
Content-Length: 0
Host: sam.msn.com
Pragma: no-cache

my target is using IE 11 with on Windows 7 with proxy configured.

Proxy is on y.y.y.y:80

target machine is not multi-homed. All its traffic is passing through the gateway only.

I don't have any access to target machine.

  • What's the gateway to the network?
    – schroeder
    Commented Oct 17, 2018 at 8:30
  • @schroeder I don't know...I don't have access to it..I guess it should be the internet router.! Commented Oct 17, 2018 at 8:41
  • What's in your config file?
    – schroeder
    Commented Oct 17, 2018 at 10:52
  • @schroeder which config.? no config editing done..it works perfect just by going directly to internet. Problem is only when going through proxy. Commented Oct 17, 2018 at 11:02
  • bettercap doesn't have a config file?
    – schroeder
    Commented Oct 17, 2018 at 11:08

1 Answer 1


You will have to ask yourself how bettercap can get a hold of traffic.

You mention three distinct machines in your scenario:

  • User IP:, G/w
  • Proxy Server IP:
  • Kali Linux (running bettercap):, G/w

But in order to better understand what's going on, you need to clear that there is another machine here, so the list would be:

  • User IP:,
  • Kali Linux (running bettercap):
  • Gateway-Machine:
  • Proxy Server IP:

Obviously, your proxy server sits on an entirely different network segment than your other three machines.

Question: Is that some in-house proxy or is the proxy possibly provided by your ISP?

In case it is an inhouse proxy, it can be reached from the User machine either through the default gateway or there must be a separate route defined to that network.

You are not saying what OS your User machine is running, but try some commands along the lines of



ip route show

to understand which way traffic to your proxy server takes. This will possibly help you understand how or why not you can eavesdrop the traffic.

Another question:

Might it be the case that your User machine is multi-homed, i.e. it has multiple network interfaces, one connected to the network and another one connected to the 172.x.x.x network? That would be a perfect explaination.

Otherwise if there are no special routes and all traffic passes through either with or without proxy, there is no good reason why you would see the traffic in once case and not see it in the other. Unless you have any filters set you forgot to tell us about, so make sure you sniff all traffic originating from or going to on all ports!

  • I've updated the question. Commented Oct 21, 2018 at 7:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .