WPA2 Half-Handshake
#2
Short answer to your question:
Yes, it is possible with latest hashcat!



Long statement:
But you don't need that tool!
Using only M1 and M2 is not a new idea.
You can use every combination of the handshake to crack the net:
M1/M2
M2/M3
M3/M4
M1/M4 (if M4 snonce is not zero)

cap2hccapx/wlancap2hcx will convert every combination of the message pairs.
They also tests the timestamp and the possibility to use hashcats --nonce-error-corrections.
Nonce error correction is possible, because of the non-existing entropy of some access points.
That means the anonce isn't random!


If you use wlandump-ng/wlanresponse to capture the traffic, you only need the M2 of a client
(booth tools generates the M1).


Messages In This Thread
WPA2 Half-Handshake - by braxxox - 08-01-2017, 04:54 PM
RE: WPA2 Half-Handshake - by ZerBea - 08-01-2017, 05:09 PM
RE: WPA2 Half-Handshake - by ZerBea - 08-01-2017, 07:11 PM
RE: WPA2 Half-Handshake - by braxxox - 08-01-2017, 10:34 PM
RE: WPA2 Half-Handshake - by ZerBea - 08-01-2017, 11:23 PM
RE: WPA2 Half-Handshake - by braxxox - 08-02-2017, 03:22 AM
RE: WPA2 Half-Handshake - by ZerBea - 08-02-2017, 06:54 AM
RE: WPA2 Half-Handshake - by ThiagoAlvarenga - 08-02-2017, 04:48 AM
RE: WPA2 Half-Handshake - by ZerBea - 08-02-2017, 07:10 AM