+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: User Contributions (https://hashcat.net/forum/forum-25.html)
+--- Thread: Empty PMKID file generated by hcxpcaptool (/thread-8647.html)
Empty PMKID file generated by hcxpcaptool - maxxer - 09-19-2019
Hi.
I hope I'm not offtopic by asking a question about hcxpcaptool usage.
I'm collecting PMKID packets using bettercap, and according to the logs some data is written to the pcap file. Unfortunately when I try to convert them to a file usable with hashcat it won't write anything.
According to the summary there are PMKIDs, but then they're not written to output.
What can be wrong? Thanks
Code:
hcxpcaptool -z bettercap-wifi-handshakes.pmkid bettercap-wifi-handshakes.pcap
reading from bettercap-wifi-handshakes.pcap
summary capture file:
---------------------
file name........................: bettercap-wifi-handshakes.pcap
file type........................: pcap 2.4
file hardware information........: unknown
capture device vendor information: 000000
file os information..............: unknown
file application information.....: unknown
network type.....................: DLT_IEEE802_11_RADIO (127)
endianness.......................: little endian
read errors......................: flawless
minimum time stamp...............: 17.09.2019 17:56:11 (GMT)
maximum time stamp...............: 17.09.2019 17:58:56 (GMT)
packets inside...................: 7
skipped packets (damaged)........: 0
packets with GPS data............: 0
packets with FCS.................: 7
EAPOL packets (total)............: 7
EAPOL packets (WPA2).............: 7
PMKIDs (not zeroed - total)......: 2
PMKIDs (WPA2)....................: 7
PMKIDs from access points........: 2
best PMKIDs (total)..............: 2
summary output file(s):
-----------------------RE: Empty PMKID file generated by hcxpcaptool - ZerBea - 09-19-2019
No, you're not offtopic.
It is a well known bettercap issue, that should be fixed, now:
https://github.com/bettercap/bettercap/issues/592
Short explanation:
bettercap didn't store ESSID information, so there is nothing to convert by requested option -z or -k.
But there are 2 PMKIDs inside the cap file that can be verified via PMK (-m 16801) and they can be converted by options -Z or -K
If you need a longer explanation (inclusive packet analysis):
https://github.com/ZerBea/hcxtools/issues/110
https://github.com/ZerBea/hcxtools/issues/109
BTW:
Why don't you run hcxdumptool?
It has many advantages. For example this one:
https://github.com/ZerBea/hcxtools/issues/112#issuecomment-532537154
Also it provides access point less attack vectors and weak candidate alerts.
RE: Empty PMKID file generated by hcxpcaptool - maxxer - 09-19-2019
Thank you very much for your answer! Unfortunately I'm on macOS so no hcxdumptool for me (at least now). I will figure out other ways, like -Z seemed to work! Thank you again
RE: Empty PMKID file generated by hcxpcaptool - ZerBea - 09-19-2019
Ok, that is a good reason. And running hcxdumptool through a VM isn't a good idea:
https://github.com/aircrack-ng/rtl8812au/issues/376#issuecomment-529123578