HCXPCAPTOOL(1) | User Commands | HCXPCAPTOOL(1) |
hcxpcaptool - hcx tools set-N
hcxpcaptool 6.0.2 (C) 2020 ZeroBeat usage: hcxpcaptool <options> hcxpcaptool <options> [input.pcap] [input.pcap] ... hcxpcaptool <options> *.cap hcxpcaptool <options> *.*
options: -o <file> : output hccapx file (hashcat -m 2500/2501) -O <file> : output raw hccapx file (hashcat -m 2500/2501)
-k <file> : output PMKID file (hashcat hashmode -m 16800 new format) -K <file> : output raw PMKID file (hashcat hashmode -m 16801 new format)
-z <file> : output PMKID file (hashcat hashmode -m 16800 old format and john) -Z <file> : output raw PMKID file (hashcat hashmode -m 16801 old format and john)
-j <file> : output john WPAPSK-PMK file (john wpapsk-opencl) -J <file> : output raw john WPAPSK-PMK file (john wpapsk-opencl)
-E <file> : output wordlist (autohex enabled) to use as input wordlist for cracker -I <file> : output unsorted identity list -U <file> : output unsorted username list -M <file> : output unsorted IMSI number list -P <file> : output possible WPA/WPA2 plainmasterkey list -T <file> : output management traffic information list
-X <file> : output client probelist
-D <file> : output unsorted device information list
-g <file> : output GPS file
-V : verbose (but slow) status output -h : show this help -v : show version
--filtermac=<mac> : filter output by MAC address
--ignore-fake-frames : do not convert fake frames --ignore-zeroed-pmks : do not convert frames which use a zeroed plainmasterkey (PMK) --ignore-replaycount : allow not replaycount checked best handshakes --ignore-mac : do not check MAC addresses
--time-error-corrections=<digit> : maximum time gap between EAPOL frames - EAPOL TIMEOUT (default: 600s) --nonce-error-corrections=<digit> : maximum replycount/nonce gap to be converted (default: 8)
--max-essid-changes=<digit> : allow maximum ESSID changes (default: 1 - no ESSID change is allowed) --eapol-out=<file> : output EAPOL packets in hex
--netntlm-out=<file> : output netNTLMv1 file (hashcat -m 5500, john netntlm) --md5-out=<file> : output MD5 challenge file (hashcat -m 4800) --md5-john-out=<file> : output MD5 challenge file (john chap) --tacacsplus-out=<file> : output TACACS+ authentication file (hashcat -m 16100, john tacacs-plus) --network-out=<file> : output network information
--hexdump-out=<file> : output dump raw packets in hex --hccap-out=<file> : output old hccap file (hashcat -m 2500) --hccap-raw-out=<file> : output raw old hccap file (hashcat -m 2500)
--nmea=<file> : save track to file
--help : show this help --version : show version
bitmask for message pair field: 0: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 1: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 2: MP info (https://hashcat.net/wiki/doku.php?id=hccapx) 3: x (unused) 4: ap-less attack (set to 1) - no nonce-error-corrections necessary 5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary 6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary 7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary
Do not edit, merge or convert pcapng files! This will remove optional comment fields! Do not use hcxpcaptool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)! It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcaptool will understand this.
The full documentation for hcxpcaptool is maintained as a Texinfo manual. If the info and hcxpcaptool programs are properly installed at your site, the command
should give you access to the complete manual.
July 2020 | hcxpcaptool 6.0.2 (C) 2020 ZeroBeat |