Everything works with bettercap. I can sniff data from http, I can downgrade https to http, dns spoof and so on.
I am not able to sniff data from http://testphp.vulnweb.com/login.php, and in no http webiste.
I always enable port forward.