hcxtools - solution for capturing wlan traffic and conversion to hashcat formats

[ZerBea]

And this is a nice test that explains why I gave it up to clean a hccapx:

Convert a cap to hccapx using both options -o and -O
$ hcxpcaptool -O testO.hccapx -o testo.hccapx 201801161903.cap
start reading from 201801161903.cap
summary:                                        
--------
file name..............: 201801161903.cap
file type..............: pcap 2.4
network type...........: DLT_IEEE802_11 (105)
endianess..............: little endian
read errors............: flawless
packets inside.........: 3153
skippedpackets.........: 0
probe requests.........: 125
probe responses........: 254
association requests...: 128
reassociation requests.: 21
EAPOL packets..........: 2612
raw handshakes.........: 179
usable handshakes......: 36

as you can see:
raw handshakes.........: 179
usable handshakes......: 36

Run hashcat using the following options on the "cleaned hccapx":
$ hashcat -m 2500 --nonce-error-corrections=8 --potfile-disable --logfile-disable --outfile-format=2 -o foundlisto testo.hccapx wordlist:
Speed.Dev.#1.....:   438.8 kH/s (2.66ms)

4 passwords recovered:
$ sort foundlisto | uniq | wc
     4       4      57

followed by a test on the "raw hccapx"
$ hashcat -m 2500 --nonce-error-corrections=0 --potfile-disable --logfile-disable --outfile-format=2 -o foundlistO testO.hccapx wordlist:
Speed.Dev.#1.....:   481.2 kH/s (2.66ms)

4 passwords recovered:
$ sort foundlistO | uniq | wc
     4       4      57

Now make up your mind:
- clean or not clean,
- nonce-error-corrections or not nonce-error-corrections,
- low value nonce-error-corrections or high value nonce-error-corrections
or any combination of this

BTW:
Do not wonder about both low speed values compared to a synthetic benchmark of a 1080TI (my wordlist is very small and that drops speed).