--pmkid option is for old 16800 hash lines. It will give an ERROR on hc22000 files.
By latest commit:
https://github.com/ZerBea/hcxtools/commi...342a6f71ad
I added an additional information to --help:
If you use --silent, hcxdumptool will become a simple dump tool like tshark, Wireshark, tcpdump. PMKIDs are not requested and a possible packet loss has to be expected.
To request PMKIDs only:
$ sudo hcxdumptool -i INTERFACE -o dump.pcapng --disable_client_attacks --disable_deauthentication --enable_status=95
For sure, some attack modes are extreme aggressive (as hell). They prevent that a CLIENT is able to connect to a NETWORK or they will let a CLIENT crash completely.
BTW:
I'm interested in a dump file from netsh hostednetwork. Can you please add a pcapng file from:
netsh wlan set hostednetwork mode=allow ssid=ap01 key=12345678 keyUsage=temporary
Usually the PMKID and the MIC should be calculated using the same PMK. It looks like this is not the case on netsh, which could be a bug inside of this tool.
From what I read here:
https://stackoverflow.com/questions/2316...e-authenti
only this types are supported by netsh:
Radio types supported : 802.11n 802.11g 802.11b
By default, PMKID caching is not activated.
By latest commit:
https://github.com/ZerBea/hcxtools/commi...342a6f71ad
I added an additional information to --help:
Code:
$ hcxhash2cap --help
hcxhash2cap 6.2.5-2-ge6c830a (C) 2021 ZeroBeat
usage:
hcxhash2cap <options>
options:
-c <file> : output cap file
if no cap file is selected, output will be written to single cap files
format: mac_sta.cap (mac_sta.cap_x)
-h : show this help
-v : show version
--pmkid-eapol=<file> : input PMKID EAPOL (22000) combi hash file
--pmkid=<file> : input deprecated PMKID (16800) hash file
--hccapx=<file> : input deprecated hccapx (2500) hash file
--hccap=<file> : input ancient hccap (2500) file
--john=<file> : input John the Ripper WPAPSK hash file
--help : show this help
--version : show versionIf you use --silent, hcxdumptool will become a simple dump tool like tshark, Wireshark, tcpdump. PMKIDs are not requested and a possible packet loss has to be expected.
To request PMKIDs only:
$ sudo hcxdumptool -i INTERFACE -o dump.pcapng --disable_client_attacks --disable_deauthentication --enable_status=95
For sure, some attack modes are extreme aggressive (as hell). They prevent that a CLIENT is able to connect to a NETWORK or they will let a CLIENT crash completely.
BTW:
I'm interested in a dump file from netsh hostednetwork. Can you please add a pcapng file from:
netsh wlan set hostednetwork mode=allow ssid=ap01 key=12345678 keyUsage=temporary
Usually the PMKID and the MIC should be calculated using the same PMK. It looks like this is not the case on netsh, which could be a bug inside of this tool.
From what I read here:
https://stackoverflow.com/questions/2316...e-authenti
only this types are supported by netsh:
Radio types supported : 802.11n 802.11g 802.11b
By default, PMKID caching is not activated.