WPA/WPA2: How the hash is generated

[abdou99]

Hi

______________________________________________________________________
Networks detected: 1BSSID=b4:ee:b4:fe:33:8b ESSID=HOTFiber-1255 (Length: 13)
--> STA=78:4f:43:10:7b:64, Message Pair=0, Replay Counter=0
--> STA=78:4f:43:10:7b:64, Message Pair=2, Replay Counter=0
--> STA=48:e9:f1:9d:73:97, Message Pair=0, Replay Counter=4
--> STA=34:fc:ef:de:aa:24, Message Pair=0, Replay Counter=4
--> STA=34:fc:ef:de:aa:24, Message Pair=2, Replay Counter=4
--> STA=48:e9:f1:9d:73:97, Message Pair=2, Replay Counter=0
Written 6 WPA Handshakes
Converted by hashC.co.uk
______________________________________________________________________

FOUND 4 UNIQ HASHES:
16450dbe240e410657e933042e78cf3f:b4eeb4fe338b:48e9f19d7397:HOTFiber-1255
8955827633067ee56d0d81cb761071e2:b4eeb4fe338b:784f43107b64:HOTFiber-1255
d41217732a6a31f5735fc08065aaa885:b4eeb4fe338b:34fcefdeaa24:HOTFiber-1255
eb78f2dde751d67f6c00b9923e387e56:b4eeb4fe338b:48e9f19d7397:HOTFiber-1255


Question:
how those hashes:
16450dbe240e410657e933042e78cf3f
8955827633067ee56d0d81cb761071e2
d41217732a6a31f5735fc08065aaa885
eb78f2dde751d67f6c00b9923e387e56

are being generated?

[philsmd]

It is actually just a kind of a checksum that is only needed internally for hashcat and wasn't meant to be something the user should care about. You shouldn't really need to know the algorithm for the checksum just to find out which networks were cracked, instead the remaining data is more important for the user.

Anyway the output format is:
checksum:mac_ap:mac_sta:essid:pass

and the (current) algo to generate the checksum is:
https://github.com/hashcat/hashcat/blob/...2835-L2884

So it basically just uses the most important bytes from the hccapx file to distinguish different hccapx-items (nothing fancy and actually nothing one need to bother with).

[abdou99]

It is actually just a kind of a checksum that is only needed internally for hashcat and wasn't meant to be something the user should care about. You shouldn't really need to know the algorithm for the checksum just to find out which networks were cracked, instead the remaining data is more important for the user.

Anyway the output format is:
checksum:mac_ap:mac_sta:essid:pass

and the (current) algo to generate the checksum is:
https://github.com/hashcat/hashcat/blob/...2835-L2884

So it basically just uses the most important bytes from the hccapx file to distinguish different hccapx-items (nothing fancy and actually nothing one need to bother with).

Hi
thanks for your reply, the algo in github is a bit not clear
can you explain it?
does it take the 393 bytes as binary then convert to hex, after that checksum ?

maybe that would be easier and better?

[Xanadrel]

Closing thread, same stuff asked on https://github.com/hashcat/hashcat/issues/1167