hashcat Forum

Hi,

I'm working on this .cap file: CAP
I already know the password, its 'tgnmtt87'.
There is a valid sequence of packets 1 and 2 of an handshake and I've successfully cracked it with aircrack-ng and pyrit (altough pyrit analyze option says its "bad").
The problem is that if i use the cap to hccap converter of hashcat.net and try to crack it with hashcat, I get no results.
I noticed that using wpaclean the output cap file contains only the packets 3 and 4 from an handshake and I can't crack it with aircrack-ng nor pyrit.

Perhaps cap to hccap uses wpaclean in the process and thats why I get an invalid hccap.

Anyone has any thoughts on this? How can I tell if an hccap is bad or good to work with?
Also how can I have a look at the contents of an hccap file?

Thank you in advance!

Yes, it uses wpaclean as it generally solves more problems as not using it

I tried it on the web converter from .cap to .hccap, and run oclhashcat64 (1.31) didn't find the password.
Then
I tried it with cap2hccap.bin in backtrack linux(VM) .cap to .haccap

make sure the cap2hccap.bin in usr/local/bin
And with this command:

cap2hccap.bin -e Mattia Mattia_mod.cap Mattia_mod.hccap
and run the OCLhascat64(1.31) in window8.1 with brute force or try dictionary , and oclhashcat found it "tgnmtt87"