Missing Frames and hcxpcapngtool
#4
For sure, hcxpcaptool/hcxpcapngtool take all basic information (BEACON, 4way handshake and/or PMKID) from a cap and pcap file and convert it to a hash file accepted by hashcat. That is old school basics.

This new tool chain:
hcxdumptool (attack the CLIENT and store additional information in pcapng comment field) -> hcxpcapngtool (evaluate and parse this information using hc22000 file format) -> hashcat (recover the PSK)
Additional information that are stored in pcapng comment fields, e.g.:
- replay count used for the attack
- MACs used for the attack
- NONCEs used for the attack
- weak candidate PSK

Is there a toolchain for taking pcap files, without the additional frames that hxcpcapngtool is looking for, and pass them to Hashcat for cracking?
That depend on the tool that you use (which tool do you use?) to attack the target and to dump the traffic to a cap/pcap/pcapng file. It also depend on filtering options that you use. Usually all 802.11 frames can/should be stored in cap, pcap and pcapng file format.


Please try the example mentioned above and ask yourself this question:
How much time will take hashcat to recover the PSK from the example by brute force method?
Reply


Messages In This Thread
Missing Frames and hcxpcapngtool - by null - 11-20-2021, 04:48 PM
RE: Missing Frames and hcxpcapngtool - by ZerBea - 11-20-2021, 05:14 PM
RE: Missing Frames and hcxpcapngtool - by null - 11-20-2021, 05:48 PM
RE: Missing Frames and hcxpcapngtool - by ZerBea - 11-20-2021, 05:53 PM
RE: Missing Frames and hcxpcapngtool - by null - 11-20-2021, 06:19 PM
RE: Missing Frames and hcxpcapngtool - by ZerBea - 11-20-2021, 06:28 PM
RE: Missing Frames and hcxpcapngtool - by ZerBea - 11-24-2021, 08:49 AM