For example,
Lets say I have a hccapx file with 5 handshakes from the same network (ssid/salt) and I have a wordlist that contains the correct WPA passcode....
Would hashcat crack the password faster if I removed 4/5 handshakes from the hccapx file? And if so, what's an easy method to remove the excess handshakes?
You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.
(06-04-2018, 07:14 AM)RealEnder Wrote: [ -> ]You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.
I was hoping to remove all redundant handshakes with the same ssid, because I'm assuming they all tried the same WPA passcode. But you're saying hashcat doesn't do any extra calculations if the ssid of the 5 captures are the same?
(06-04-2018, 03:40 AM)royce Wrote: [ -> ]I *think* you can do something along those lines with hcxtools?
https://github.com/ZerBea/hcxtools
I actually tried that tool in a The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux vm box but I couldn't get past the "makefile" command. It kept giving me errors
IIRC, I think I needed to add a library or something first.
If you poke around this forum, I think there may be a post that talks about this.