NAME

hcxpcapngtool - hcx tools set-N

DESCRIPTION

hcxpcapngtool 6.0.2 (C) 2020 ZeroBeat usage: hcxpcapngtool <options> hcxpcapngtool <options> input.pcapng hcxpcapngtool <options> *.pcapng hcxpcapngtool <options> *.pcap hcxpcapngtool <options> *.cap hcxpcapngtool <options> *.*

short options: -o <file> : output PMKID/EAPOL hash file

: hashcat -m 22000/22001 and JtR wpapsk-opencl/wpapsk-pmk-opencl

-E <file> : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker -I <file> : output unsorted identity list to use as input wordlist for cracker -U <file> : output unsorted username list to use as input wordlist for cracker -h : show this help -v : show version

long options: --all : convert all possible hashes instead of only the best one

that can lead to much overhead hashes: use hcxhashtool to filter hashes need hashcat --nonce-error-corrections >= 8

--eapoltimeout=<digit> : set EAPOL TIMEOUT (milliseconds)

: : default: 5000 ms

--nonce-error-corrections=<digit> : set nonce error correction

warning: values > 0 can lead to uncrackable handshakes: : default: 0

--ignore-ie : do not use CIPHER and AKM information

this will convert all frames regadless of: CIPHER and/OR AKM information, and can lead to uncrackable hashes

--max-essids=<digit> : maximum allowed ESSIDs

default: 1 ESSID: disregard ESSID changes and take ESSID with highest ranking

--eapmd5=<file> : output EAP MD5 CHALLENGE (hashcat -m 4800) --eapmd5-john=<file> : output EAP MD5 CHALLENGE (john chap) --eapleap=<file> : output EAP LEAP CHALLENGE (hashcat -m 5500, john netntlm) --nmea=<file> : output GPS data in NMEA format

format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL: to convert it to gpx, use GPSBabel: gpsbabel -i nmea -f hcxdumptool.nmea -o gpx -F file.gpx to display the track, open file.gpx with viking

--log=<file> : output logfile --raw-out=<file> : output frames in HEX ASCII

: : format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM

--raw-in=<file> : input frames in HEX ASCII

: : format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM

--pmkid=<file> : output deprecated PMKID file (delimter *) --hccapx=<file> : output deprecated hccapx v4 file --hccap=<file> : output deprecated hccap file --john=<file> : output deprecated PMKID/EAPOL (JtR wpapsk-opencl/wpapsk-pmk-opencl) --prefix=<file> : convert everything to lists using this prefix (overrides single options):

-o <file.22000>: : output PMKID/EAPOL hash file
-E <file.essid>: : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker
-I <file.identitiy>: : output unsorted identity list to use as input wordlist for cracker
-U <file.username>: : output unsorted username list to use as input wordlist for cracker
--eapmd5=<file.4800>: : output EAP MD5 CHALLENGE (hashcat -m 4800)
--eapleap=<file.5500> : output EAP LEAP CHALLENGE (hashcat -m 5500, john netntlm): --nmea=<file.nmea> : output GPS data in NMEA format

--help : show this help --version : show version

bitmask for message pair field: 0: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 1: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 2: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 3: x (unused) 4: ap-less attack (set to 1) - no nonce-error-corrections necessary 5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary 6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary 7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

Do not edit, merge or convert pcapng files! This will remove optional comment fields! Detection of bit errors does not work on cleaned dump files! Do not use hcxpcapngtool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)! It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this.

NAME

DESCRIPTION

SEE ALSO