Please note, this is a STATIC archive of website hashcat.net from 08 Oct 2020, cach3.com does not collect or store any user information, there is no "phishing" involved.

hashcat Forum

Full Version: Question about hccapx file
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
For example,
Lets say I have a hccapx file with 5 handshakes from the same network (ssid/salt) and I have a wordlist that contains the correct WPA passcode....

Would hashcat crack the password faster if I removed 4/5 handshakes from the hccapx file? And if so, what's an easy method to remove the excess handshakes?
I am not aware of a tool to edit hccapx.
Have a try with the philsmd's repo https://github.com/philsmd?tab=repositories
I *think* you can do something along those lines with hcxtools?

https://github.com/ZerBea/hcxtools
You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.
(06-04-2018, 07:14 AM)RealEnder Wrote: [ -> ]You can remove some handshakes with hcxtools or with any other tool, that can work with binary data, but how do you know what handshakes to remove? If there is a forced one (AP-less), you can use that without nonce correction and this might be your best bet.
If you have the same essid, PMK for each password candidate over all handshakes is computed only once and this is the heaviest part. Depending on nonce correction you're using, speed loss will be negligible with 1 vs 5 handshakes.

I was hoping to remove all redundant handshakes with the same ssid, because I'm assuming they all tried the same WPA passcode. But you're saying hashcat doesn't do any extra calculations if the ssid of the 5 captures are the same?
(06-04-2018, 03:40 AM)royce Wrote: [ -> ]I *think* you can do something along those lines with hcxtools?

https://github.com/ZerBea/hcxtools

I actually tried that tool in a The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux vm box but I couldn't get past the "makefile" command. It kept giving me errors
IIRC, I think I needed to add a library or something first.

If you poke around this forum, I think there may be a post that talks about this.