+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: Question about hccapx file (/thread-7538.html)
Question about hccapx file - veggiebiker2500 - 06-01-2018
For example,
Lets say I have a hccapx file with 5 handshakes from the same network (ssid/salt) and I have a wordlist that contains the correct WPA passcode....
Would hashcat crack the password faster if I removed 4/5 handshakes from the hccapx file? And if so, what's an easy method to remove the excess handshakes?
RE: Question about hccapx file - Mem5 - 06-03-2018
I am not aware of a tool to edit hccapx.
Have a try with the philsmd's repo https://github.com/philsmd?tab=repositories
RE: Question about hccapx file - royce - 06-04-2018
I *think* you can do something along those lines with hcxtools?
https://github.com/ZerBea/hcxtools
RE: Question about hccapx file - RealEnder - 06-04-2018
You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.
RE: Question about hccapx file - veggiebiker2500 - 06-04-2018
(06-04-2018, 07:14 AM)RealEnder Wrote: You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.
I was hoping to remove all redundant handshakes with the same ssid, because I'm assuming they all tried the same WPA passcode. But you're saying hashcat doesn't do any extra calculations if the ssid of the 5 captures are the same?
RE: Question about hccapx file - veggiebiker2500 - 06-04-2018
(06-04-2018, 03:40 AM)royce Wrote: I *think* you can do something along those lines with hcxtools?
https://github.com/ZerBea/hcxtools
I actually tried that tool in a The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux vm box but I couldn't get past the "makefile" command. It kept giving me errors
RE: Question about hccapx file - walterlacka - 06-05-2018
IIRC, I think I needed to add a library or something first.
If you poke around this forum, I think there may be a post that talks about this.