HashCat [Hex]

[ZerBea]

The hash I got was from a handshake capture using a WiFi pineapple. I copied the hash out of the hashcat file that was provided by the pineapple and then entered it in quotes.
Example:
sudo hashcat -a 0 -w 0 “[hash]” rockyou.txt
The last line returned [Hex] 123456789 —> [Hex]123456789

I copied each of the numbers and pasted them in an online Hex converter that gave me two phrases (one for each Hex).

WiFi (802.11) hashes are not(!) md5 (hash mode -m 0)! They look like this (hash mode -m 22000) :
22000 WPA-PBKDF2-PMKID+EAPOL in case a PMKID was captured:

Code:

WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***

22000 WPA-PBKDF2-PMKID+EAPOL in case a 4way handshake was captured:

Code:

WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2

Both taken from:
https://hashcat.net/wiki/doku.php?id=example_hashes

Read more here:
https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
and related to WiFi Pineapples:
https://forums.hak5.org/topic/44213-pmki.../#comments


Rockyou list is very old and not related to WiFi. There are much better lists:
https://wpa-sec.stanev.org/dict/cracked.txt.gz
https://3wifi.stascorp.com/3wifi-dic-2022-06-03.7z
https://hashmob.net/research/hashmob

and hashcat attack modes:
https://hashcat.net/wiki/

BTW:
Do not run "sudo" on hashcat. That is neither mandatory nor necessary.