Hello everyone,
I'm trying to converting a .cap which should contain a valid handshake to a compatible hashcat format for cracking it.
First of all I want to clarify that I'm testing my own iphone hotspot.
Tshark seems to say that the file is valid and contains a valid handshake while cowpatty seems to say the contrary.
And in fact cowpatty seems to be right since hashcat conversion tool gives me an error when trying to convert:
https://hashcat.net/cap2hashcat/
I tried multiple times to capture the handshake on the same network but not once worked.
I have performed the capture using Bettercap.
The strange thing is that with other networks the handshake seems to be captured well and the conversion using https://hashcat.net/cap2hashcat/ works fine.
At this point I'd like to understand by what this problem is caused and how can I avoid it.
I'm trying to converting a .cap which should contain a valid handshake to a compatible hashcat format for cracking it.
First of all I want to clarify that I'm testing my own iphone hotspot.
Tshark seems to say that the file is valid and contains a valid handshake while cowpatty seems to say the contrary.
Code:
tshark -r handshake_iphone_XX-XX-XX-XX-XX-XX_2024-12-04T22-44-53.cap -n -Y eapol
12453 26.126857 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 155 Key (Message 1 of 4)
12456 26.159267 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 164 Key (Message 2 of 4)
12458 26.173381 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 221 Key (Message 3 of 4)
17148 39.072576 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 180 Key (Message 2 of 4)
17150 39.084851 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 221 Key (Message 3 of 4)
17152 39.091372 XX:XX:XX:XX:XX:XX → XX:XX:XX:XX:XX:XX EAPOL 133 Key (Message 4 of 4)
tshark: The file "handshake_iphone_XX-XX-XX-XX-XX-XX_2024-12-04T22-44-53.cap" appears to have been cut short in the middle of a packet.Code:
cowpatty -r handshake_iphone_XXXXX_....cap -s 'iphone di XXXXXX' -c
cowpatty 4.8 - WPA-PSK dictionary attack. <jwright@hasborg.com>
End of pcap capture file, incomplete four-way handshake exchange. Try using a
different capture.And in fact cowpatty seems to be right since hashcat conversion tool gives me an error when trying to convert:
https://hashcat.net/cap2hashcat/
Code:
Handshake extraction failed!
hcxpcapngtool 6.3.1 reading from 1368442_1733672727.cap...
failed to read packet 17227
summary capture file
--------------------
file name................................: 1368442_1733672727.cap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 04.12.2024 22:44:13
timestamp maximum (GMT)..................: 04.12.2024 22:44:53
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11 (105) very basic format without any additional information about the quality
endianness (capture system)..............: little endian
packets inside...........................: 17227
ESSID (total unique).....................: 1
BEACON (total)...........................: 1
BEACON on 2.4 GHz channel (from IE_TAG)..: 6
ACTION (total)...........................: 16
PROBERESPONSE (total)....................: 52
DEAUTHENTICATION (total).................: 512
AUTHENTICATION (total)...................: 8
AUTHENTICATION (OPEN SYSTEM).............: 2
AUTHENTICATION (SAE).....................: 6
ASSOCIATIONREQUEST (total)...............: 2
ASSOCIATIONREQUEST (SAE SHA256)..........: 2
WPA encrypted............................: 45
EAPOL messages (total)...................: 6
EAPOL RSN messages.......................: 6
EAPOL ANONCE error corrections (NC)......: not detected
EAPOL M1 messages (total)................: 1
EAPOL M1 messages (KDV:0 AKM defined)....: 1 (PMK not recoverable)
EAPOL M2 messages (total)................: 2
EAPOL M2 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable)
EAPOL M3 messages (total)................: 2
EAPOL M3 messages (KDV:0 AKM defined)....: 2 (PMK not recoverable)
EAPOL M4 messages (total)................: 1
EAPOL M4 messages (KDV:0 AKM defined)....: 1 (PMK not recoverable)
RSN PMKID (total)........................: 1
RSN PMKID (KDV:0 AKM defined)............: 1 (PMK not recoverable)
packet read error........................: 1
Information: limited dump file format detected!
This file format is a very basic format to save captured network data.
It is recommended to use PCAP Next Generation dump file format (or pcapng for short) instead.
The PCAP Next Generation dump file format is an attempt to overcome the limitations
of the currently widely used (but very limited) libpcap (cap, pcap) format.
https://www.wireshark.org/docs/wsug_html_chunked/AppFiles.html#ChAppFilesCaptureFilesSection
https://github.com/pcapng/pcapng
Information: radiotap header is missing!
Radiotap is a de facto standard for 802.11 frame injection and
reception. The radiotap header format is a mechanism to supply
additional information about frames, rom the driver to userspace
applications.
https://www.radiotap.org/
Warning: too many deauthentication/disassociation frames detected!
That can cause that an ACCESS POINT change channel, reset EAPOL TIMER,
renew ANONCE and set PMKID to zero.
This could prevent to calculate a valid EAPOL MESSAGE PAIR
or to get a valid PMKID.
Information: missing frames!
This dump file does not contain undirected proberequest frames.
An undirected proberequest may contain information about the PSK.
It always happens if the capture file was cleaned or
it could happen if filter options are used during capturing.
That makes it hard to recover the PSK.
Information: missing frames!
This dump file does not contain enough EAPOL M1 frames.
It always happens if the capture file was cleaned or
it could happen if filter options are used during capturing.
That makes it impossible to calculate nonce-error-correction values.
Information: no hashes written to hash files
session summary
---------------
processed cap files...................: 1I tried multiple times to capture the handshake on the same network but not once worked.
I have performed the capture using Bettercap.
The strange thing is that with other networks the handshake seems to be captured well and the conversion using https://hashcat.net/cap2hashcat/ works fine.
At this point I'd like to understand by what this problem is caused and how can I avoid it.
