I'm running Debian10/KDE with the nftables firewall enabled on my host machine and would like to test my phone. In the virtual machine I'm running Kali Linux with bettercap and am trying to sniff traffic from my phone connected to the same local network. I used bettercap exactly like in this guide for example.

However, after running net.probe on and browsing with my phone it doesn't capture any traffic or show any error message (or any other output). Now I don't know if it's working, how to test it and which problems it has. The only error message I got in bettercap was: "https.proxy error reading SNI: EOF." But I didn't get this every time and not after running the commands to start sniffing. Sometimes browsing on the phone works just like before, sometimes it's a bit slower and sometimes the connections time out.

Furthermore, after starting the Web UI with http-ui on after having changed the username and password in /usr/share/bettercap/caplets/http-ui.cap and opening localhost in the browser I only get a blank page which has bettercap set as the page title and the bettercap favicon.

Because I did not get any error/info messages in bettercap I'm not sure what might be the problems. I suspect it's the fairly restrictive nftables firewall on my host machine / some settings for forwarding that cause both problems. I already made some changes to it and checked /proc/sys/net/ipv4/ip_forward and the iptables rules in the VM.

Update: I created an issue at the bettercap repo for the blank Web UI but capturing traffic still doesn't really work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.