+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: PMKID cracked but which AP? (/thread-8517.html)
PMKID cracked but which AP? - bob_abounds - 07-28-2019
So I captured 22 PMKIDs, exported with hcxtpcapool, cracked one of the PMKIDs but the result shows what looks like a hash string and then the plaintext password.
Results below:
"9d155eb5bfe7f2371840c702e21f7a6e7af2d60d5c2c0b4fbace2ed71cf62fa9:amazinf"
How do i find the AP it belongs to?
RE: PMKID cracked but which AP? - philsmd - 07-28-2019
As you can see here https://hashcat.net/wiki/doku.php?id=example_hashes the hash format is designed in a way that it has the MAC addresses etc in it to easily recognize the network.
Which versions of hashcat/hcxtools do you use ?
RE: PMKID cracked but which AP? - bob_abounds - 07-28-2019
Thanks for the fast reply Phil. I'm using Hashcat 5.1.0 and ZerBea's most recent release of hcxtools.
My Hashcat output did not come separated by an asterisk like the examples on the link. Would the last twelve characters of the hash string be the AP's MAC?
RE: PMKID cracked but which AP? - philsmd - 07-28-2019
try https://hashcat.net/beta/ . a lot of things changed already since last release of latest hashcat version