hcxtools
A set of tools for converting captured Wi-Fi frames. It is able to convert between different formats and hashes for use with the latest versions of Hashcat or John the Ripper.
The letters in the title mean:
- h = hash
- c = capture, convert and calculate candidates – now the capture function is divided into a separate program hcxdumptool.
- x = different hashtypes
These tools are 100% compatible with hashcat and John the Ripper and are recommended by the Hashcat author. Released new versions of hcxtools are very closely synchronized with the latest versions of hashcat on Git (meaning: the latest hcxtools match the latest hashcat beta) and the John the Ripper (“bleeding-jumbo”) Git branch.
The following hash modes are supported for hashcat: 4800, 5500, 2200x, 16100, 250x (deprecated), 1680x (deprecated)
The following hash modes are supported for John the Ripper: WPAPSK-PMK, PBKDF2-HMAC-SHA1, chap, netntlm, tacacs-plus.
It supports hashes (one file per archive) compressed in gzip (.gz) format.
List of hcxtools toolkit
| Tool | Description |
|---|---|
| hcxpcapngtool | Converts captured wireless frames with handshakes and PMKIDs to hashes of the new hashcat 22000 format. |
| hcxhashtool | Shows information about PMKID/EAPOL hashes and provides various filtering operations with new PMKID/EAPOL hashes. |
| hcxpsktool | Generates password candidates for hashcat and john to brute force based on hcxpcapngtool output or command line input. |
| hcxpmktool | Calculate and verify a PSK and/or a PMK |
| hcxeiutool | Prepares dictionaries obtained from the output of the hcxpcapngtool command when using the -E, -I, and -U options for use in a hashcat + rule or JtR + rule. |
| hcxwltool | Calculates candidates for hashcat and john based on mixed wordlists |
| hcxhash2cap | Converts hash file (PMKID&EAPOL, PMKID, EAPOL-hccapx, EAPOL-hccap, WPAPSK-john) to cap |
| wlancap2wpasec | Upload multiple (gzip compressed) pcapng, pcap and cap files to https://wpa-sec.stanev.org |
| whoismac | Show vendor information and/or download oui reference list |
hcxtools Help
hcxtools is a common name of a set of tools, each executes only one specific function, and each has option set.
hcxpcapngtool Help
Converts captured wireless frames with handshakes and PMKIDs to hashes of the new hashcat 22000 format.
hcxpcapngtool hcxpcapngtool input.pcapng hcxpcapngtool *.pcapng hcxpcapngtool *.pcap hcxpcapngtool *.cap hcxpcapngtool *.*
short options: -o : output WPA-PBKDF2-PMKID+EAPOL hash file (hashcat -m 22000) get full advantage of reuse of PBKDF2 on PMKID and EAPOL -E : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker retrieved from every frame that contain an ESSID -R : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker retrieved from PROBEREQUEST frames only -I : output unsorted identity list to use as input wordlist for cracker -U : output unsorted username list to use as input wordlist for cracker -D : output device information list format MAC MANUFACTURER MODELNAME SERIALNUMBER DEVICENAME UUID -h : show this help -v : show version long options: --all : convert all possible hashes instead of only the best one that can lead to much overhead hashes use hcxhashtool to filter hashes need hashcat --nonce-error-corrections >= 8 --eapoltimeout= : set EAPOL TIMEOUT (milliseconds) : default: 5000 ms --nonce-error-corrections= : set nonce error correction warning: values > 0 can lead to uncrackable handshakes : default: 0 --ignore-ie : do not use CIPHER and AKM information this will convert all frames regadless of CIPHER and/OR AKM information, and can lead to uncrackable hashes --max-essids= : maximum allowed ESSIDs default: 1 ESSID disregard ESSID changes and take ESSID with highest ranking --eapmd5= : output EAP MD5 CHALLENGE (hashcat -m 4800) --eapmd5-john= : output EAP MD5 CHALLENGE (john chap) --eapleap= : output EAP LEAP and MSCHAPV2 CHALLENGE (hashcat -m 5500, john netntlm) --tacacs-plus= : output TACACS PLUS (hashcat -m 16100, john tacacs-plus) --nmea= : output GPS data in NMEA format format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL to convert it to gpx, use GPSBabel: gpsbabel -i nmea -f hcxdumptool.nmea -o gpx,gpxver=1.1 -F hcxdumptool.gpx to display the track, open file.gpx with viking --csv= : output ACCESS POINT information in CSV format delimiter: tabulator (0x08) columns: YYYY-MM-DD HH:MM:SS MAC_AP ESSID ENC_TYPE CIPHER AKM COUNTRY_INFO CHANNEL RSSI GPS(DM.m) GPS(D.d) GPSFIX SATCOUNT HDOP ALTITUDE UNIT to convert it to other formats, use bash tools or scripting languages GPS FIX: 0 = fix not available or invalid 1 = fix valid (GPS SPS mode) 2 = fix valid (differential GPS SPS Mode) 3 = not supported 4 = not supported 5 = not supported 6 = fix valid (Dead Reckoning Mode) --log= : output logfile --raw-out= : output frames in HEX ASCII : format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM --raw-in= : input frames in HEX ASCII : format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM --pmkid= : output deprecated PMKID file (delimter *) --hccapx= : output deprecated hccapx v4 file --hccap= : output deprecated hccap file --john= : output deprecated PMKID/EAPOL (JtR wpapsk-opencl/wpapsk-pmk-opencl) --prefix= : convert everything to lists using this prefix (overrides single options): -o : output PMKID/EAPOL hash file -E : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker -I : output unsorted identity list to use as input wordlist for cracker -U : output unsorted username list to use as input wordlist for cracker --eapmd5= : output EAP MD5 CHALLENGE (hashcat -m 4800) --eapleap= : output EAP LEAP and MSCHAPV2 CHALLENGE (hashcat -m 5500, john netntlm) --tacacs-plus= : output TACACS+ (hashcat -m 16100, john tacacs-plus) --nmea= : output GPS data in NMEA format --help : show this help --version : show version
Bitmask of message pair field:
2,1,0: 000 = M1+M2, EAPOL from M2 (challenge) 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed 010 = M2+M3, EAPOL from M2 (authorized) 011 = M2+M3, EAPOL from M3 (authorized) - unused 100 = M3+M4, EAPOL from M3 (authorized) - unused 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed 3: reserved 4: ap-less attack (set to 1) - nonce-error-corrections not required 5: LE router detected (set to 1) - nonce-error-corrections required only on LE 6: BE router detected (set to 1) - nonce-error-corrections required only on BE 7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections mandatory
Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!
Do not use hcxpcapngtool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)! It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this.
Recommended tools to show additional 802.11 fields or to decrypt WiFi traffic: Wireshark and/or tshark
Recommended tool to filter converted hash by several options: hcxhashtool
Recommended tool to get default or standard PSKs: hcxpsktool
Recommended tool to calculate wordlists based on ESSID: hcxeiutool
Recommended tools to retrieve PSK from hash: hashcat, JtR
hcxpcapngtool usage examples
Convert captured wireless frames (dumpfile.pcapng file) to hashes (will be saved to dumpfile.pcapng file) with extraction of password candidates (will be saved to wordlist.txt file):
hcxpcapngtool -o hash.hc22000 -E wordlist.txt dumpfile.pcapng
com.s33me If You Want Some
Nothing fancy, just a personal repository of tech crap et. al.
Widespread Augmented Reality
Click on the image to get the Android Augmented Reality Heads up Display
Sunday, December 30, 2018
Kali Linux WiFite missing hcxpcaptool and hcxdumptool
Resolve Warning: Recommended app hcxpcaptool hcxdumptool was not found.
Go to the hcxdumptool git hub site
Find the clone of download drop down button.
Right click on download zip and copy the link address.
Open and Kali Linux terminal and type: wget [the link address], e.g. wget https://github.com/ZerBea/hcxdumptool/archive/master.zip
Wait for download then type unzip master.zip
CD (change directory) to hcxdumptool-master
Type make
Type sudo make install
Follow these same steps for the hcxpcaptool.
For example: wget https://github.com/ZerBea/hcxtools/archive/master.zip
You may find it first necessary to run the following:
sudo apt-get update
sudo apt-get install libssl-dev
sudo apt-get install openssl
sudo apt-get install zlib1g-dev
sudo apt-get install libpcap-dev
sudo apt-get install curl
sudo apt-get install libcurl4 ( or greater )
wget https://curl.haxx.se/download/curl-7.63.0.tar.gz
:~/tar -xvzf curl-7.48.0.tar.gz
:~/rm *.gz
:~/cd curl-7.48.0
:~/./configure
:~/sudo make
:~/sudo make install