3.
run hashcat on hash-mode 4800 using the wordlist
$ hashcat -m 4800 --potfile-path=hc4800.pot hashes4800 wordlist
hashcat (v3.6.0-247-g8f2cbb26) starting...
Session..........: hashcat
Status...........: Cracked
Hash.Type........: iSCSI CHAP authentication, MD5(CHAP)
Hash.Target......: hashes4800
Time.Started.....: Fri Jul 21 17:45:43 2017 (0 secs)
Time.Estimated...: Fri Jul 21 17:45:43 2017 (0 secs)
Guess.Base.......: File (wordlist)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....: 0 H/s (0.02ms)
Recovered........: 2/2 (100.00%) Digests, 2/2 (100.00%) Salts
Progress.........: 14/14 (100.00%)
Rejected.........: 0/14 (0.00%)
Restore.Point....: 0/7 (0.00%)
Candidates.#1....: beaVIs -> blamo
HWMon.Dev.#1.....: Temp: 44c Fan: 30% Util:100% Core:1202MHz Mem:3004MHz Bus:8
take a look into the potfile
$ cat hc4800.pot
9920418b3103652d3b80ffff04da5863:00000000000000000000000000000000:02:bradtest
1ffc6c2659bc5bb94144fd01eb756e37:d7ec2fff2ada437f9dcd4e3b0df44d50:02:beaVIs
You cracked your first WPA-ENTERPRISE using hash-mode 4800
run hashcat on hash-mode 4800 using the wordlist
$ hashcat -m 4800 --potfile-path=hc4800.pot hashes4800 wordlist
hashcat (v3.6.0-247-g8f2cbb26) starting...
Session..........: hashcat
Status...........: Cracked
Hash.Type........: iSCSI CHAP authentication, MD5(CHAP)
Hash.Target......: hashes4800
Time.Started.....: Fri Jul 21 17:45:43 2017 (0 secs)
Time.Estimated...: Fri Jul 21 17:45:43 2017 (0 secs)
Guess.Base.......: File (wordlist)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....: 0 H/s (0.02ms)
Recovered........: 2/2 (100.00%) Digests, 2/2 (100.00%) Salts
Progress.........: 14/14 (100.00%)
Rejected.........: 0/14 (0.00%)
Restore.Point....: 0/7 (0.00%)
Candidates.#1....: beaVIs -> blamo
HWMon.Dev.#1.....: Temp: 44c Fan: 30% Util:100% Core:1202MHz Mem:3004MHz Bus:8
take a look into the potfile
$ cat hc4800.pot
9920418b3103652d3b80ffff04da5863:00000000000000000000000000000000:02:bradtest
1ffc6c2659bc5bb94144fd01eb756e37:d7ec2fff2ada437f9dcd4e3b0df44d50:02:beaVIs
You cracked your first WPA-ENTERPRISE using hash-mode 4800