cap to hccapx problem [Zero value timestamps detected]
#2
That isn't a cap2hccapx issue.
The timestamps are zeroed in your cap file. Additional you're missing some important frames (authentication, association, undirected proberequest frames).
Code:
$ hcxpcapngtool --hccapx=test.hccapx HAKAN-FC-4A-E9-14-EC-9B.cap
reading from HAKAN-FC-4A-E9-14-EC-9B.cap...

summary capture file
--------------------
file name................................: HAKAN-FC-4A-E9-14-EC-9B.cap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 01.01.1970 01:00:00
timestamp maximum (GMT)..................: 01.01.1970 01:00:00
link layer header type...................: DLT_IEEE802_11 (105)
endianess (capture system)...............: little endian
packets inside...........................: 3
BEACON (total)...........................: 1
EAPOL messages (total)...................: 2
EAPOL RSN messages.......................: 2
ESSID (total unique).....................: 1
EAPOLTIME gap (measured maximum usec)....: 4999998
EAPOL ANONCE error corrections (NC)......: not detected
EAPOL M1 messages........................: 1
EAPOL M2 messages........................: 1
EAPOL pairs (total)......................: 1
EAPOL pairs (best).......................: 1
EAPOL pairs written to hccapx............: 1 (RC checked)
EAPOL M12E2..............................: 1
PMKID (total)............................: 1
PMKID (best).............................: 1
packets with zeroed timestamps...........: 3

Warning: missing frames!
This dump file contains no important frames like
authentication, association or reassociation.
That makes it hard to recover the PSK.

Warning: missing frames!
This dump file contains no undirected proberequest frames.
An undirected proberequest may contain information about the PSK.
That makes it hard to recover the PSK.

Warning: missing frames!
This dump file doesn't contain enough EAPOL M1 frames.
That makes it impossible to calculate nonce-error-correction values.

Warning: missing timestamps!
This dump file contains frames with zeroed timestamps.
That prevent calculation of EAPOL TIMEOUT values.

Do not clean your cap file.
Do not use tools that do that.
Do not use tools that ignore important frames.

In times of GPU hash cracking tools (hashcat), there is absolutely no need to clean a cap file.
cap2hccapx will not convert deadly cleaned cap files, because you possible waste GPU time if you try to recover the PSK from them.
multicapconverter will do the conversion:
https://github.com/s77rt/multicapconverter
as well as hcxpcapngtool (with a bunch of warnings):
https://github.com/ZerBea

BTW:
You cap files contain PMKIDs. You should use them (hashmode 22000 or 16800) instead of EAPOL (hashmode 2500/hccapx)!
Reply


Messages In This Thread
RE: cap to hccapx problem [Zero value timestamps detected] - by ZerBea - 02-11-2020, 02:15 PM