hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
As long as john can handle both (PMKID) formats, there is no need to add the long format to hcxtools. I recommend testing john with the (22000) examples hashes. Everything is running fast and smooth.

cons:
Regarding WPA EAPOL MESSAGEs you should know that john is internally using the ancient hccap binary format. In combination with the conversion to an ASCII hash file format this produce unnecessary overhead and conversion time. Luckily that is on the todo list (feature request).
Unfortunately john is not able to do nonce-error-corrections (NC). So it is a good idea to use hcxpcapngtool --all to convert pcapng files to john's format.

pros:
Due to full reuse of PBKDF2 when running against a hash file that contains more than one hash with the same ESSID, john's single mode attack (--single or --single:all) is much faster (with the NC hints mentioned above) than hashcat's association attack (-a9). And it is easier to use, because it is not necessary to pre-process the hash file to get a MAC address list or an ESSID list hashcat can work on.
Reply


Messages In This Thread
wlandump-ng vs hcxdumptool - by hulley - 02-10-2018, 10:26 PM
RE: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats - by ZerBea - 09-22-2025, 07:38 AM