Bettercap: TLS Handshake Details

TL;DR

This guide shows you how to get more detailed information about the TLS handshake phase when using Bettercap, helping you understand what’s happening during a secure connection. We’ll focus on enabling verbose logging and interpreting the output.

1. Enable Verbose Logging

By default, Bettercap doesn’t show all the details of the TLS handshake. You need to turn on verbose logging to see more information. Use the -v or --verbose flag when starting Bettercap.

bettercap -v

2. Start Your Capture

Start your capture as usual, targeting the network interface you want to monitor. For example:

bettercap -v --iface eth0

3. Run TLS Interception (If Applicable)

If you’re intercepting TLS traffic (e.g., with tls.spoof), make sure it’s running. This guide applies to both passive monitoring and active interception.

net.sniff on
tls.spoof on

4. Observe the Output

With verbose logging enabled, Bettercap will print a lot more information to the console as TLS handshakes occur. Look for lines that start with ‘TLS Handshake’. These lines contain key details.

5. Understanding the TLS Handshake Phases

The TLS handshake involves several phases. Here’s what you might see and what it means:

• Client Hello: The client initiates the connection by sending a ‘Client Hello’ message. This includes supported cipher suites, TLS versions, and random data.
• Server Hello: The server responds with a ‘Server Hello’, selecting a cipher suite and TLS version to use.
• Certificate Exchange: The server sends its certificate (and potentially intermediate certificates) to the client for verification.
• Key Exchange: This phase establishes a shared secret key between the client and server. Different methods are used, such as RSA, Diffie-Hellman, or Elliptic Curve Diffie-Hellman (ECDHE).
• Change Cipher Spec & Finished: Both client and server send ‘Change Cipher Spec’ messages to indicate they’re switching to encrypted communication, followed by ‘Finished’ messages to confirm the handshake is complete.

Bettercap will show you these phases as they happen.

6. Identifying Key Information

Pay attention to these details in the output:

• Cipher Suite: The negotiated cipher suite (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). This tells you which encryption algorithm is being used.
• TLS Version: The TLS version in use (e.g., TLSv1.3). Newer versions are generally more secure.
• Server Certificate Details: Check the issuer, subject, and validity dates of the server certificate to verify its authenticity.

7. Filtering Output

If you’re capturing a lot of traffic, it can be hard to find specific TLS handshakes. You can use tools like grep to filter the output:

bettercap -v --iface eth0 | grep 'TLS Handshake'

8. Saving Output to a File

To analyze the handshake details later, you can redirect Bettercap’s output to a file:

bettercap -v --iface eth0 > tls_handshakes.log

9. Using Wireshark for Deeper Analysis

For even more detailed analysis, you can save the capture in PCAP format and open it with Wireshark. Wireshark provides a graphical interface to inspect all the TLS messages.

bettercap -v --iface eth0 --dump tcp_capture.pcap