hashcat Forum

(08-31-2011, 06:28 AM)forumhero Wrote: [ -> ]i only ask because pyrit didn't scale well at all. single hd5970 was getting about 140,000 pmks. someone ran 4xhd5970 and only got 280,000 pmks

yes, of course! i have meassured on 8 x 6970 and 4 x 5970: scales perfect

Just wondering, why the special format? Why the patch to convert from pcap to hccap? Wouldn't it have been easier (forgive the ignorance on this one) to just have the gpu-hashcats deal directly with ordinary pcap files themselves?

yeah but i am to lazy to code .cap parser

(08-31-2011, 12:54 PM)atom Wrote: [ -> ]yeah but i am to lazy to code .cap parser

Hi atom

I can completely understand your lack of enthusiasm to make a .cap parser for hashcatplus.

I think I can speak for all the users of hashcat when I say that I (assume everyone) is extremely grateful for all your work and especially considering you are kind enough to give it all away for free.

I assume you are probably the sort of person who enjoys working out how to do the actual cracking (more technical side) than bothering with the issues less experienced users, like myself, may face. This is presumably why you concentrate on the serious code rather than a GUI etc.

However even though I understand the above, would you please reconsider taking the time to make a parser to allow hashcatplus to be able to crack standard .cap files ? This would really help less experienced users out and I suspect you will save not only yourself time but the forum contributors here a lot of time in the future.

I say this because believe you may experience a lot of forum posts claiming hashcat “doesn’t work” or other false claims as people try to use normal .cap files. I also guess that there will be many who will not understand how to do the converting themselves and people here will be constantly answering questions about this subject.

I admit I know nothing about the time it will take you to make this parser but I thought I would ask you now before you release the latest version and attract the problems I mentioned.

Please reconsider making a parser for hashcatplus.

(08-31-2011, 09:22 AM)atom Wrote: [ -> ]

(08-31-2011, 06:28 AM)forumhero Wrote: [ -> ]i only ask because pyrit didn't scale well at all. single hd5970 was getting about 140,000 pmks. someone ran 4xhd5970 and only got 280,000 pmks

yes, of course! i have meassured on 8 x 6970 and 4 x 5970: scales perfect

can we see a result of those multi gpu monsters ?
i was talking about 1 million wpa/sec ?=

i have 4xhd5970 if atom needs testers ;-)

oclHashcat-lite64.exe --hash-type 1000 --custom-charset1 ?l?u?d?s --pw-min 8 --pw-max 8 --gpu-accel 400 ffffffffffffffffffffffffffffffff ?1?1?1?1?1?1?1?1

Status.......: Running
Hash.Type....: NTLM
Time.Running.: 12 secs
Time.Left....: 1 day, 4 hours
Plain.Text...: **p1?oba
Plain.Length.: 8
Speed........: 65.4G/s
Progress.....: 846815232000/6634204312890625 (0.01%)
HW.Monitor.#1: 96% GPU, 78c Temp
HW.Monitor.#2: 96% GPU, 78c Temp
HW.Monitor.#3: 96% GPU, 78c Temp
HW.Monitor.#4: 96% GPU, 78c Temp
HW.Monitor.#5: 96% GPU, 78c Temp
HW.Monitor.#6: 96% GPU, 78c Temp
HW.Monitor.#7: 96% GPU, 78c Temp
HW.Monitor.#8: 96% GPU, 78c Temp

(08-31-2011, 04:01 PM)Hash-IT Wrote: [ -> ]

(08-31-2011, 12:54 PM)atom Wrote: [ -> ]yeah but i am to lazy to code .cap parser

Hi atom

I can completely understand your lack of enthusiasm to make a .cap parser for hashcatplus.

I think I can speak for all the users of hashcat when I say that I (assume everyone) is extremely grateful for all your work and especially considering you are kind enough to give it all away for free.

I assume you are probably the sort of person who enjoys working out how to do the actual cracking (more technical side) than bothering with the issues less experienced users, like myself, may face. This is presumably why you concentrate on the serious code rather than a GUI etc.

However even though I understand the above, would you please reconsider taking the time to make a parser to allow hashcatplus to be able to crack standard .cap files ? This would really help less experienced users out and I suspect you will save not only yourself time but the forum contributors here a lot of time in the future.

I say this because believe you may experience a lot of forum posts claiming hashcat “doesn’t work” or other false claims as people try to use normal .cap files. I also guess that there will be many who will not understand how to do the converting themselves and people here will be constantly answering questions about this subject.

I admit I know nothing about the time it will take you to make this parser but I thought I would ask you now before you release the latest version and attract the problems I mentioned.

Please reconsider making a parser for hashcatplus.

hello hash-it,

thanks for these words. well i thought again about it. but i am still sure its better not to touch .cap parsing code. coding a simple .cap parser wouldnt be a problem. if the .cap is perfect, its easy. but what if there were retransmissions or corrupted packets? that happens often, especially at WLAN.

what i want to say is: the devil is in the detail. from my opinion its better to leave handling of these packets to the people who work on a daily basis with it.

one thing i can do is to setup a converter-page here on hashcat.net. so that not so experienced users do not need to deal with aircrack-ng. and for those who do not want to upload their .cap to a strange place, well they can do locally with my aircrack-ng patch.

(09-01-2011, 09:22 AM)atom Wrote: [ -> ]hello hash-it,

thanks for these words. well i thought again about it. but i am still sure its better not to touch .cap parsing code. coding a simple .cap parser wouldnt be a problem. if the .cap is perfect, its easy. but what if there were retransmissions or corrupted packets? that happens often, especially at WLAN.

what i want to say is: the devil is in the detail. from my opinion its better to leave handling of these packets to the people who work on a daily basis with it.

one thing i can do is to setup a converter-page here on hashcat.net. so that not so experienced users do not need to deal with aircrack-ng. and for those who do not want to upload their .cap to a strange place, well they can do locally with my aircrack-ng patch.

Hi atom

Thank you very much for taking the time to reply and especially for coming up with a good plan for the future.

I think I understand the problems you are taking about as I have found out the hard way, that not all WPA captures are usable !

Personally I always use Pyrit and Cowpatty to “verify” that I have a good capture file before attempting a key recovery with EWSA. Maybe this will provide you with some ideas ?

Code I use to do this…

pyrit -r capfile.cap analyze

cowpatty -r capfile.cap analyze


Your idea of a web page is great ! Can I be a bit cheeky and make some suggestions for it ? Please just ignore me if I am asking too much.

Could you please think about……

Make it available via SSL. Even a homemade certificate would be better than none at all.

Allow users to upload fairly large cap files, maybe up to 2 – 3 MB.

Perhaps automatically strip the junk using something like the code in wireshark. I use this filter in wireshark…

eapol || wlan.fc.type_subtype == 0x08

Then "save as" and select "All packets" and "Displayed"

Save as a .cap file

This leaves just the handshake and a beacon frame.

Allow users to use your page to strip and check .cap files and download them as normal .cap files (for use with other programs) and also the new hcap format.

Perhaps running some sort of code in java on the local machine may save on bandwidth and user privacy ? Apologies for my ignorance on this if that won’t help.

I also wonder if someone from the aircrack team would help make a standalone .cap file stripper and checker ? This would be awesome just a simple exe that users could clean, strip and check their .cap files with before trying to recover them.

Anyway I will leave my suggestions here as I could go on all day with ideas for this but it wouldn’t be fair to take up anymore of your time.

Thanks again.

check out this: https://hashcat.net/cap2hccap

what you think?

(09-02-2011, 05:39 PM)atom Wrote: [ -> ]check out this: https://hashcat.net/cap2hccap

what you think?

What do I think ???? Well.....

My dog looks like this....




When he see's these....



And today I looked very much like my dog !


Thank you soooo much atom.