DOKK / manpages / debian 11 / hcxtools / hcxpcapngtool.1.en
HCXPCAPNGTOOL(1) User Commands HCXPCAPNGTOOL(1)

hcxpcapngtool - hcx tools set-N

hcxpcapngtool 6.0.2 (C) 2020 ZeroBeat usage: hcxpcapngtool <options> hcxpcapngtool <options> input.pcapng hcxpcapngtool <options> *.pcapng hcxpcapngtool <options> *.pcap hcxpcapngtool <options> *.cap hcxpcapngtool <options> *.*

short options: -o <file> : output PMKID/EAPOL hash file

hashcat -m 22000/22001 and JtR wpapsk-opencl/wpapsk-pmk-opencl

-E <file> : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker -I <file> : output unsorted identity list to use as input wordlist for cracker -U <file> : output unsorted username list to use as input wordlist for cracker -h : show this help -v : show version

long options: --all : convert all possible hashes instead of only the best one

use hcxhashtool to filter hashes need hashcat --nonce-error-corrections >= 8

--eapoltimeout=<digit> : set EAPOL TIMEOUT (milliseconds)

: default: 5000 ms

--nonce-error-corrections=<digit> : set nonce error correction

: default: 0

--ignore-ie : do not use CIPHER and AKM information

CIPHER and/OR AKM information, and can lead to uncrackable hashes

--max-essids=<digit> : maximum allowed ESSIDs

disregard ESSID changes and take ESSID with highest ranking

--eapmd5=<file> : output EAP MD5 CHALLENGE (hashcat -m 4800) --eapmd5-john=<file> : output EAP MD5 CHALLENGE (john chap) --eapleap=<file> : output EAP LEAP CHALLENGE (hashcat -m 5500, john netntlm) --nmea=<file> : output GPS data in NMEA format

to convert it to gpx, use GPSBabel: gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx to display the track, open file.gpx with viking

--log=<file> : output logfile --raw-out=<file> : output frames in HEX ASCII

: format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM

--raw-in=<file> : input frames in HEX ASCII

: format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM

--pmkid=<file> : output deprecated PMKID file (delimter *) --hccapx=<file> : output deprecated hccapx v4 file --hccap=<file> : output deprecated hccap file --john=<file> : output deprecated PMKID/EAPOL (JtR wpapsk-opencl/wpapsk-pmk-opencl) --prefix=<file> : convert everything to lists using this prefix (overrides single options):

: output PMKID/EAPOL hash file
: output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker
: output unsorted identity list to use as input wordlist for cracker
: output unsorted username list to use as input wordlist for cracker
: output EAP MD5 CHALLENGE (hashcat -m 4800)
--nmea=<file.nmea> : output GPS data in NMEA format

--help : show this help --version : show version

bitmask for message pair field: 0: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 1: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 2: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 3: x (unused) 4: ap-less attack (set to 1) - no nonce-error-corrections necessary 5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary 6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary 7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

Do not edit, merge or convert pcapng files! This will remove optional comment fields! Detection of bit errors does not work on cleaned dump files! Do not use hcxpcapngtool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)! It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this.

The full documentation for hcxpcapngtool is maintained as a Texinfo manual. If the info and hcxpcapngtool programs are properly installed at your site, the command

info hcxpcapngtool

should give you access to the complete manual.

July 2020 hcxpcapngtool 6.0.2 (C) 2020 ZeroBeat