Please note, this is a STATIC archive of website hashcat.net from 08 Oct 2020, cach3.com does not collect or store any user information, there is no "phishing" involved.

hashcat Forum

Full Version: Empty PMKID file generated by hcxpcaptool
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Hi.
I hope I'm not offtopic by asking a question about hcxpcaptool usage.

I'm collecting PMKID packets using bettercap, and according to the logs some data is written to the pcap file. Unfortunately when I try to convert them to a file usable with hashcat it won't write anything.

According to the summary there are PMKIDs, but then they're not written to output.

What can be wrong? Thanks

Code:
hcxpcaptool -z bettercap-wifi-handshakes.pmkid bettercap-wifi-handshakes.pcap

reading from bettercap-wifi-handshakes.pcap

summary capture file:
---------------------
file name........................: bettercap-wifi-handshakes.pcap
file type........................: pcap 2.4
file hardware information........: unknown
capture device vendor information: 000000
file os information..............: unknown
file application information.....: unknown
network type.....................: DLT_IEEE802_11_RADIO (127)
endianness.......................: little endian
read errors......................: flawless
minimum time stamp...............: 17.09.2019 17:56:11 (GMT)
maximum time stamp...............: 17.09.2019 17:58:56 (GMT)
packets inside...................: 7
skipped packets (damaged)........: 0
packets with GPS data............: 0
packets with FCS.................: 7
EAPOL packets (total)............: 7
EAPOL packets (WPA2).............: 7
PMKIDs (not zeroed - total)......: 2
PMKIDs (WPA2)....................: 7
PMKIDs from access points........: 2
best PMKIDs (total)..............: 2

summary output file(s):
-----------------------
No, you're not offtopic.
It is a well known bettercap issue, that should be fixed, now:
https://github.com/bettercap/bettercap/issues/592

Short explanation:
bettercap didn't store ESSID information, so there is nothing to convert by requested option -z or -k.
But there are 2 PMKIDs inside the cap file that can be verified via PMK (-m 16801) and they can be converted by options -Z or -K

If you need a longer explanation (inclusive packet analysis):
https://github.com/ZerBea/hcxtools/issues/110
https://github.com/ZerBea/hcxtools/issues/109

BTW:
Why don't you run hcxdumptool?
It has many advantages. For example this one:
https://github.com/ZerBea/hcxtools/issue...-532537154
Also it provides access point less attack vectors and weak candidate alerts.
Thank you very much for your answer! Unfortunately I'm on macOS so no hcxdumptool for me (at least now). I will figure out other ways, like -Z seemed to work! Thank you again
Ok, that is a good reason. And running hcxdumptool through a VM isn't a good idea:
https://github.com/aircrack-ng/rtl8812au...-529123578