hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Good idea, and this will help old hccap users a lot.
Your hashcat version doesn't support nonce-error-corrections (NC). That exactly is the reason why some of your hashes are not recoverable. NC is an amazing feature (used by hashcat and hcxtools) to compensate a packet loss during reception. Usually it works on M1 frames, transmitted by an access point (AP) during the same authentication sequence. It works as long as the AP doesn't renew his random values and his EAPOL counters.
Take a look at this example to explore the advantage of NC:
https://hashcat.net/forum/thread-8910-po...l#pid47400

"I suppose the most useful or important issue would be for hcxpcapngtool not to output any hccap files which are not crackable. Is it possible for you to please add the Key MIC check during conversion?"
-> If I were able to do this, we do not need hashcat any longer and hashcat will become obsolete.
Validating MICs and/or PMKIDs is hashcat domain. hcxtools/hcxdumptool only have the power to check a single weak candidate, a single PMK or a zeroed PMK. Apart from this, I promised Atom not to do this (coding a GPU based hash cracker). Also I don't want to blame me, because hashcat can do this much faster and better than I ever could do it.

BTW:
hccap isn't removed:
$ hcxhashtool -h
--hccap=<file> : output to ancient hccap file

convert pcapng to 22000 hashline, get the the hashes you would like to test and save them to hccap

Once you split your hccap files just do a search for the ESSID:
$ grep -r your_essid
and it will show you the hccap file which matches.

BTW 2:
Grouping to old hccap format doesn't make sense, because your hashcat version doesn't handle reuse of PBKDF2. Running an old version of hashcat, it is much better to convert only one single hash and feed hashcat with it. Choose this hash carefully, otherwise you will waste your time and the time of your old GPU.
Reply


Messages In This Thread
wlandump-ng vs hcxdumptool - by hulley - 02-10-2018, 10:26 PM
RE: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats - by ZerBea - 01-29-2020, 04:32 PM