240 lines
8.4 KiB
HTML
240 lines
8.4 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self' data:; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self' https://defcon.social https://bsky.app;">
|
|
<meta http-equiv="X-Content-Type-Options" content="nosniff">
|
|
<link rel="stylesheet" href="../assets/css/style.css">
|
|
<link rel="icon" type="image/x-icon" href="../favicon.ico">
|
|
<script>
|
|
(function() {
|
|
const theme = localStorage.getItem('theme') ||
|
|
(window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
|
|
document.documentElement.setAttribute('data-theme', theme);
|
|
})();
|
|
</script>
|
|
<title>hcxpcapngtool Cheatsheet - Cheatsheets - Launch Pad</title>
|
|
</head>
|
|
<body>
|
|
<button class="theme-toggle" id="themeToggle" aria-label="Toggle dark mode">
|
|
<svg class="theme-icon theme-icon-moon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg>
|
|
<svg class="theme-icon theme-icon-sun" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="display: none;"><circle cx="12" cy="12" r="5"></circle><line x1="12" y1="1" x2="12" y2="3"></line><line x1="12" y1="21" x2="12" y2="23"></line><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line><line x1="1" y1="12" x2="3" y2="12"></line><line x1="21" y1="12" x2="23" y2="12"></line><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line></svg>
|
|
</button>
|
|
<br/><br/>
|
|
<div class="name">
|
|
__ _______________________ _________._________________________
|
|
\_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/
|
|
| __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_
|
|
| \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \
|
|
\___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ /
|
|
\/ \/ \/ \/ \/ \/ \/
|
|
</div>
|
|
<div class="blog-page-header">
|
|
<div class="blog-header-content">
|
|
<a href="/cheatsheets" class="back-link" title="Back to Cheatsheets">
|
|
<svg xmlns="http://www.w3.org/2000/svg" width="42" height="42" viewBox="0 0 24 24" class="home-icon"><path fill="currentColor" d="M10 20v-6h4v6h5v-8h3L12 3 2 12h3v8z"/></svg>
|
|
</a>
|
|
<h1 class="blog-page-title">hcxpcapngtool Cheatsheet</h1>
|
|
</div>
|
|
</div>
|
|
<div class="blog-post-container">
|
|
<div class="blog-posts-container" style="max-width: 900px; margin: 0 auto;">
|
|
<div class="blog-post">
|
|
<div class="blog-post-content">
|
|
<p><a href="index.html">← Back to cheatsheets</a></p>
|
|
<p><a href="../index.html">← Home</a></p>
|
|
<hr>
|
|
<p>hcxpcapngtool converts and analyzes WiFi captures. It extracts WPA/WPA2 handshakes, PMKID hashes, and converts pcapng files to formats compatible with hashcat and other password cracking tools.</p>
|
|
<hr>
|
|
<h2>Basic Usage</h2>
|
|
<ul>
|
|
<li>hcxpcapngtool -o <output> <input> - Convert to hashcat format</li>
|
|
</ul>
|
|
<ul>
|
|
<li>hcxpcapngtool -o hash.hc22000 capture.pcapng - Convert to hc22000 (PMKID)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>hcxpcapngtool -o hash.hc22000 -z capture.pcapng - Convert with EAPOL (handshake)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Input/Output Options</h2>
|
|
<ul>
|
|
<li>-o <file> - Output file</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-k <file> - Output PMKID to file</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-E <file> - Output ESSID wordlist</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-I <file> - Output identity wordlist</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-P <file> - Output passwords</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-Z <file> - Output weak passphrases</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-z <file> - Output EAPOL hashes (handshake)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Analysis Options</h2>
|
|
<ul>
|
|
<li>--info - Show capture information</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--timeline - Show timeline of captures</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--list - List all captured networks</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--filter=<bssid> - Filter by BSSID</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--filter-ap=<bssid> - Filter AP by BSSID</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--filter-client=<mac> - Filter client by MAC</li>
|
|
</ul>
|
|
<ul>
|
|
<li>--psk - Show PSK (if known)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Hash Format Conversion</h2>
|
|
<ul>
|
|
<li>-o <file>.hc22000 - Output in hc22000 format (PMKID + EAPOL)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-o <file>.16800 - Output in 16800 format (PMKID)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-o <file>.2500 - Output in 2500 format (WPA/WPA2 handshake)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>-o <file>.hccapx - Output in hccapx format (legacy)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>PMKID Extraction</h2>
|
|
<ul>
|
|
<li>hcxpcapngtool -o pmkid.hc22000 capture.pcapng - Extract PMKID</li>
|
|
</ul>
|
|
<ul>
|
|
<li>PMKID captured in first EAPOL message from AP</li>
|
|
</ul>
|
|
<ul>
|
|
<li>No client needed for PMKID capture</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Format: PMKID*MAC_AP*MAC_CLIENT*ESSID*PSK</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Handshake Extraction</h2>
|
|
<ul>
|
|
<li>hcxpcapngtool -o handshake.hc22000 -z capture.pcapng - Extract handshake</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Requires complete 4-way handshake</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Combined with PMKID in hc22000 format</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Common Examples</h2>
|
|
<h3>Basic Conversion</h3>
|
|
<pre><code>hcxpcapngtool -o hash.hc22000 capture.pcapng</code></pre>
|
|
<h3>Convert with Handshake</h3>
|
|
<pre><code>hcxpcapngtool -o hash.hc22000 -z capture.pcapng</code></pre>
|
|
<h3>Show Capture Info</h3>
|
|
<pre><code>hcxpcapngtool --info capture.pcapng</code></pre>
|
|
<h3>List Networks</h3>
|
|
<pre><code>hcxpcapngtool --list capture.pcapng</code></pre>
|
|
<h3>Extract PMKID Only</h3>
|
|
<pre><code>hcxpcapngtool -o pmkid.hc22000 -k pmkid.txt capture.pcapng</code></pre>
|
|
<h3>Extract ESSID Wordlist</h3>
|
|
<pre><code>hcxpcapngtool -E essid_list.txt capture.pcapng</code></pre>
|
|
<h3>Filter by BSSID</h3>
|
|
<pre><code>hcxpcapngtool --filter-ap=AA:BB:CC:DD:EE:FF -o hash.hc22000 capture.pcapng</code></pre>
|
|
<h3>Convert Multiple Files</h3>
|
|
<pre><code>hcxpcapngtool -o combined.hc22000 capture1.pcapng capture2.pcapng</code></pre>
|
|
<h3>Legacy Format</h3>
|
|
<pre><code>hcxpcapngtool -o hash.hccapx capture.pcapng</code></pre>
|
|
<hr>
|
|
<h2>Hashcat Integration</h2>
|
|
<h3>PMKID Attack</h3>
|
|
<pre><code>hashcat -m 22000 hash.hc22000 wordlist.txt</code></pre>
|
|
<h3>Handshake Attack</h3>
|
|
<pre><code>hashcat -m 22000 hash.hc22000 wordlist.txt</code></pre>
|
|
<h3>hc22000 format supports both PMKID and handshakes</h3>
|
|
<hr>
|
|
<h2>File Formats</h2>
|
|
<ul>
|
|
<li>hc22000 - Modern format (PMKID + EAPOL handshake), hashcat mode 22000</li>
|
|
</ul>
|
|
<ul>
|
|
<li>16800 - PMKID only, hashcat mode 16800</li>
|
|
</ul>
|
|
<ul>
|
|
<li>2500 - WPA/WPA2 handshake, hashcat mode 2500</li>
|
|
</ul>
|
|
<ul>
|
|
<li>hccapx - Legacy format, hashcat mode 2500</li>
|
|
</ul>
|
|
<ul>
|
|
<li>pcapng - Original capture format (Wireshark compatible)</li>
|
|
</ul>
|
|
<hr>
|
|
<h2>Workflow</h2>
|
|
<ol>
|
|
<li>Capture with hcxdumptool: <code>hcxdumptool -i wlan0mon -o capture.pcapng</code></li>
|
|
<li>Convert with hcxpcapngtool: <code>hcxpcapngtool -o hash.hc22000 capture.pcapng</code></li>
|
|
<li>Crack with hashcat: <code>hashcat -m 22000 hash.hc22000 wordlist.txt</code></li>
|
|
</ol>
|
|
<hr>
|
|
<h2>Tips</h2>
|
|
<ul>
|
|
<li>hc22000 format is preferred (supports both PMKID and handshakes)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Use --info to verify capture quality before converting</li>
|
|
</ul>
|
|
<ul>
|
|
<li>PMKID doesn't require complete handshake (faster capture)</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Use -z flag to include EAPOL handshake hashes</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Filter by BSSID to extract specific networks</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Combine multiple captures into single hash file</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Use --list to see what networks were captured</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Extract ESSID wordlist for targeted attacks</li>
|
|
</ul>
|
|
<ul>
|
|
<li>Always test on authorized networks only</li>
|
|
</ul>
|
|
<ul>
|
|
<li>hc22000 format works with hashcat mode 22000</li>
|
|
</ul>
|
|
<hr>
|
|
<p><a href="index.html">← Back to cheatsheets</a></p>
|
|
<p><a href="../index.html">← Home</a></p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<script async type="text/javascript" src="../blog/analytics.js"></script>
|
|
<script src="../theme.js"></script>
|
|
</body>
|
|
</html>
|
|
|