Since version 6.0.0, hashcat accepts the new hash mode 22000:

 22000 | WPA-PBKDF2-PMKID+EAPOL
 22001 | WPA-PMK-PMKID+EAPOL

Benefits of hash mode 22000:

• The hash line combines PMKIDs and EAPOL MESSAGE PAIRs in a single file
• Having all the different handshake types in a single file allows for efficient reuse of PBKDF2 to save GPU cycles
• It is no longer a binary format that allows various standard tools to be used to filter or process the hashes
• It is no longer a binary format which makes it easier to copy / paste anywhere as it is just text
• The best tools for capturing and filtering WPA handshake output in hash mode 22000 format (see tools below)

Difference between hash mode 22000 and hash mode 22001:

• Use hash mode 22000 to recover a Pre-Shared-Key (PSK). Length of a PSK can be 8 up to 63 characters
• Use hash mode 22001 to verify an existing (pre-calculated) Plain Master Key (PMK). Length of a PMK is always 64 xdigits

hashcat has supported mode 22000 since version 6.0. For the capture and conversion commands below, use current, compatible versions of hcxdumptool and hcxtools:

• hcxdumptool: https://github.com/ZerBea/hcxdumptool
• hcxpcapngtool, from hcxtools: https://github.com/ZerBea/hcxtools
• hashcat: https://github.com/hashcat/hashcat

Optionally there is hcxlabtool, which you can use as an experienced user or in headless operation instead of hcxdumptool: https://github.com/ZerBea/wifi_laboratory

For users who don't want to struggle with compiling hcxtools from sources there is an online converter: https://hashcat.net/cap2hashcat/

If you choose the online converter, you may need to remove some data from your dump file if the file size is too large. Most of the time, this happens when data traffic is also being recorded.

You can reduce the size with tshark:

tshark -r dumpfile.cap -Y "(wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x02 || wlan.fc.type_subtype == 0x04 || wlan.fc.type_subtype == 0x05 || wlan.fc.type_subtype == 0x08 || eapol)" -F pcapng -w stripped.pcapng

Do not clean up the cap / pcap file (e.g. with wpaclean), as this will remove useful and important frames from the dump file. Do not use filtering options while collecting WiFi traffic.

Do not merge pcapng dump files, because that can destroy useful metadata.

The hcxdumptool / hcxlabtool offers several attack modes that other tools do not.

This includes the PMKID attack, which is described here: https://hashcat.net/forum/thread-7717.html

It also includes AP-less client attacks and a lot more.

The capture is saved in pcapng format, which Wireshark and tshark can read. It includes metadata such as nonces, replay counters and MAC addresses. hcxpcapngtool uses this metadata when it extracts hashes.

In addition, hashcat is told how to handle the hash via the message pair field. When hcxdumptool is connected to a GPS device, it also saves the GPS coordinates of the frames.

Examples of the target and how traffic is captured:

1. Stop services that are using the WLAN device, such as NetworkManager and wpa_supplicant.service.

$ sudo systemctl stop NetworkManager.service
$ sudo systemctl stop wpa_supplicant.service

2. Start the attack and wait for you to receive PMKIDs and / or EAPOL message pairs, then exit hcxdumptool

Do not set monitor mode by third party tools.

Do not run hcxdumptool on a virtual interface.

Do not run hcxdudmptool at the same time in combination with tools that take access to the interface (except Wireshark, tshark).

$ hcxdumptool -i INTERFACE_NAME -w dumpfile.pcapng --rds=1 -F

3. Restart stopped services to reactivate your network connection

$ sudo systemctl start wpa_supplicant.service
$ sudo systemctl start NetworkManager.service

4. Convert the traffic to hash format 22000

$ hcxpcapngtool -o hash.hc22000 dumpfile.pcapng

Make sure you are in the correct working directory.

5. Run hashcat with a wordlist of candidate passwords

$ hashcat -m 22000 hash.hc22000 wordlist.txt

Make sure you are in the correct working directory.

For more options, see the tools help menu (-h or --help) or this thread.

Get more examples from here.

Run hashcat on an excellent WPA word list or check out their free online service:

Code: $ wget https://wpa-sec.stanev.org/dict/cracked.txt.gz $ hashcat -m 22000 test.hc22000 cracked.txt.gz

Get more examples from here: https://github.com/hashcat/hashcat/issues/2923

Explanation of the hc22000 hash line

WPA*01*PMKID*MAC_AP*MAC_CLIENT*ESSID***MESSAGEPAIR
WPA*02*MIC*MAC_AP*MAC_CLIENT*ESSID*NONCE_AP*EAPOL_CLIENT*MESSAGEPAIR

Explanation of the MESSAGEPAIR fields

bitmask of message pair field PMKID (WPA*01):
0: reserved
1: PMKID taken from AP
2: reserved
4: PMKID taken from CLIENT (wlan.da: possible MESH or REPEATER)
5: reserved
6: reserved
7: reserved


bitmask of message pair field EAPOL (WPA*02):
2,1,0:
 000 = M1+M2, EAPOL from M2 (challenge)
 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
 010 = M2+M3, EAPOL from M2 (authorized)
 011 = M2+M3, EAPOL from M3 (authorized) - unused
 100 = M3+M4, EAPOL from M3 (authorized) - unused
 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
3: reserved
4: ap-less attack (set to 1) - nonce-error-corrections not required
5: LE router detected (set to 1) - nonce-error-corrections required only on LE
6: BE router detected (set to 1) - nonce-error-corrections required only on BE
7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections mandatory

Examples to work on hc22000 hash files:

Filter hash file by PMKID

$ grep 'WPA\*01' hash.hc22000 > pmkid.hc22000
or
$ hcxhashtool -i hash.hc22000 --type=1 -o pmkid.hc22000

Filter hash file by EAPOL

$ grep 'WPA\*02' hash.hc22000 > eapol.hc22000
or
$ hcxhashtool -i hash.hc22000 --type=2 -o eapol.hc22000

Filter by authorized EAPOL MESSAGEPAIR

$ grep '2$' hash.hc22000
or
$ hcxhashtool -i hash.hc22000 --authorized -o authorized.hc22000

Filter by challenge EAPOL MESSAGEPAIR

$ grep '0$' hash.hc22000
or
$ hcxhashtool -i hash.hc22000 --challenge -o challenge.hc22000

Filter by MAC

$ grep '\*112233445566\*'  hash.hc22000 > mac.hc22000
or
$ hcxhashtool -i hash.hc22000 --mac-ap=112233445566 -o macap.hc22000
or
$ hcxhashtool -i hash.hc22000 --mac-client=112233445566 -o macclient.hc22000

Use of the original .cap and .hccapx formats is no longer supported. Files in .cap format can be converted for use with current tools. Files in .hccapx format cannot.

hashcat is very flexible, so I'll cover three most common and basic scenarios:

1. Dictionary attack
2. Brute-Force attack
3. Rule-based attack

• Grab a wordlist, like C-nets from wpa-sec.stanev.org.
• Put it into the hashcat folder.
• On Windows, create a batch file “attack.bat”, open it with a text editor, and paste the following:

$ hashcat -m 22000 hash.hc22000 cracked.txt.gz
on Windows add:
$ pause

Execute the attack using the batch file, which should be changed to suit your needs.

• Create a batch file “attack.bat”, open it with a text editor, and paste the following:

$ hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
on Windows add:
$ pause

This tries every digits-only string of length 8. Replace the ?d as needed.

It would be wise to first estimate the time it would take to process using a calculator.

TBD: add some example timeframes for common masks / common speed

This is similar to a Dictionary attack, but the commands look a bit different:

$ hashcat -m 22000 hash.hc22000 -r rules/best66.rule cracked.txt.gz
on Windows add:
$ pause

This will mutate the wordlist with the best66 ruleset, which comes with the hashcat distribution. It used to be called best64.rule and was renamed.

Change as necessary and remember, the time it will take the attack to finish will increase proportionally with the amount of rules.

What are rules?

This page was partially adapted from this forum post, which also includes some details for developers.