Cap file convert to hccapx HELP
#1
İ cant convert this file to hccapx or  PMKID files

can some one help me?
i dont know how to use hcxtools

https://s2.dosya.tc/server12/021cqr/Turk...8.cap.html

Thanks
Reply
#2
(02-12-2020, 06:06 PM)ZerBea Wrote: https://www.onlinehashcrack.com/tools-ca...verter.php
running hcxtools!

This tool is under maintenance. Please note that the hccapx format is now DEPRECATED.
Sad
Reply
#3
Ok, thanks.
Please note that the hccapx format is now DEPRECATED
-> I know: hccapx is a dinosaur (R.i.P)
https://github.com/hashcat/hashcat/issues/1816
Reply
#4
@Uraniumhazee
I think its against forum rules posting your hashes.

Code:
Zero value timestamps detected in file: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap. This prevents correct EAPOL-Key timeout calculation. Do not use preprocess the capture file with tools such as wpaclean.

Edit: used cap2hccapx from hashcat-utils
Reply
#5
@Uraniumhazee
Here you told us, that you're using wifislax:
https://hashcat.net/forum/thread-8959-po...l#pid47563
This is the forum of wifislax:
https://foro.seguridadwireless.net/
Maybe it's a bug inside wifislax. I recommend to ask there, why the timestamps are zeroed and why some frames are not present in the cap file. Also it's a good idea to ask which tools are used, to identify what caused the issue exactly.
A zeroed timestamp is definitely a bug. Maybe the wifislax developer doesn't know about this issue.
If you like, please attach the warning from cap2hccapx (@skalderis) and the detailed warning from hcxpcapngtool:
Code:
$ hcxpcapngtool TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap reading from TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap... summary capture file -------------------- file name................................: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap version (pcap/cap).......................: 2.4 (very basic format without any additional information) timestamp minimum (GMT)..................: 01.01.1970 01:00:00 timestamp maximum (GMT)..................: 01.01.1970 01:00:00 link layer header type...................: DLT_IEEE802_11 (105) endianess (capture system)...............: little endian packets inside...........................: 3 BEACON (total)...........................: 1 EAPOL messages (total)...................: 2 EAPOL RSN messages.......................: 2 ESSID (total unique).....................: 1 EAPOLTIME gap (measured maximum usec)....: 4999998 EAPOL ANONCE error corrections (NC)......: not detected EAPOL M1 messages........................: 1 EAPOL M2 messages........................: 1 EAPOL pairs (total)......................: 1 EAPOL pairs (best).......................: 1 EAPOL M12E2..............................: 1 PMKID (total)............................: 1 PMKID (best).............................: 1 packets with zeroed timestamps...........: 3 Warning: missing frames! This dump file contains no important frames like authentication, association or reassociation. That makes it hard to recover the PSK. Warning: missing frames! This dump file contains no undirected proberequest frames. An undirected proberequest may contain information about the PSK. That makes it hard to recover the PSK. Warning: missing frames! This dump file doesn't contain enough EAPOL M1 frames. That makes it impossible to calculate nonce-error-correction values. Warning: missing timestamps! This dump file contains frames with zeroed timestamps. That prevent calculation of EAPOL TIMEOUT values.

as well as the warning from wpapcap2john (JtR):
Code:
$ wpapcap2john -vv TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap ** ** Warning: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap seems to be processed with some dubious tool like ** 'wpaclean'. Important information may be lost. **

as well as the result from muticapconverter:
Code:
$ ./multicapconverter.py --input=TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap --export=hcwpax --all [!] No Networks found
Reply