Understanding EAPOL 4-Way Handshake and PMKID cracking
#10
Running that combination nc=2 doesn't make sense.
Either use the automatic or run nc=0.
That depend on the quality of your captured traffic and the sensitivity of your device (PLCP errors).
You can do a simple test to check this:

Get wordlist from here:
https://wpa-sec.stanev.org/dict/cracked.txt.gz

$ hcxpcangtool -o test 22000 dumpfile.pcapng

$ time hashcat -m 22000 --potfile-disable test.22000 cracked.txt
compare recovered PSKs and time with
$ time hashcat -m 22000 --potfile-disable test.22000 --nonce-error-corrections=0 cracked.txt
and compare recovered PSKs and time with
$ time hashcat -m 22000 --potfile-disable test.22000 --nonce-error-corrections=8 cracked.txt
Now you should have the best option(s).
Reply


Messages In This Thread
RE: Understanding EAPOL 4-Way Handshake and PMKID cracking - by ZerBea - 04-01-2020, 06:50 PM