hashcat Forum
.pcapng file issue - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat-utils, maskprocessor, statsprocessor, md5stress, wikistrip (https://hashcat.net/forum/forum-28.html)
+--- Thread: .pcapng file issue (/thread-11273.html)



.pcapng file issue - Say10 - 01-26-2023

First off, if this has been answered, I apologize, I was unable to find the answer anywhere on the forums.

Here's my issue.
when I run the command "-hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=15" and then "hcxpcapngtool -o hash.hc22000 -E BssidList dumpfile.pcapng", I correctly end up with a hash.hc22000, but when I attempt to view the file with cat or anything else I get

".��8/r�Ƹ�qR�]}H�#�G1�;��"|�F=�;!��(h�7�Tk�?�z�kXl%yu"

That's just one line, but the entire hash.hc22000 looks like that.

What the hell could I be doing wrong?

-I'm using Parrot OS - everything is up-to-date
-hcxpcaptool 6.0.2
-hcxdumptool 6.0.5
-I ran a driver check - it passed
-I ran "file dumpfile.pcapng" in my terminal window - it verified that it is a .pcapng

Any help would be greatly appreciated!


RE: .pcapng file issue - ZerBea - 01-26-2023

Your versions are outdated. Please update to latest version:
hcxdumptool = 6.2.7
hcxpcapngtool = 6.2.7

A hc.22000 file is HEX ASCII (not binary) and it should look like this:
Code:
WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***
WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2
https://hashcat.net/wiki/doku.php?id=example_hashes
Please notice that hcxpcapngtool append all output files to existing files.
A wrong command line can cause that the output of -o (hc22000) is appended to a dump file or a damaged hc22000 file. If that happened, it look exactly like your output:
Code:
!!�:�2�1��z�_j��2�1�� �6�c�
Remove old hash.hc22000 and convert again.

To verify your dump file, you can upload it here:
https://hashcat.net/cap2hashcat/
or here:
https://wpa-sec.stanev.org/?submit
or open it with Wireshark.
In every case, hcxpcapngtool print details of the dump file.


RE: .pcapng file issue - Say10 - 01-26-2023

I really appreciate the reply, thanks a ton! I'll do as instructed.


RE: .pcapng file issue - Say10 - 01-28-2023

So, for whatever reason, I was unable to update hcxdump/;pcapngtool to the latest version on ParrotOS, so I threw it on The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) and installed the drivers from github. Installing the tools from github to Parrot was a no-go, it throws a bunch of errors, too many and beyond my level of understanding.
Anyway, everything seems to be working now.

But thanks for the help, not to mention all the years you've put into this tool! You're a boss!