@Uraniumhazee
I think its against forum rules posting your hashes.
Code:
Zero value timestamps detected in file: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap.
This prevents correct EAPOL-Key timeout calculation.
Do not use preprocess the capture file with tools such as wpaclean.
Edit: used cap2hccapx from hashcat-utils
@Uraniumhazee
Here you told us, that you're using wifislax:
https://hashcat.net/forum/thread-8959-po...l#pid47563
This is the forum of wifislax:
https://foro.seguridadwireless.net/
Maybe it's a bug inside wifislax. I recommend to ask there, why the timestamps are zeroed and why some frames are not present in the cap file. Also it's a good idea to ask which tools are used, to identify what caused the issue exactly.
A zeroed timestamp is definitely a bug. Maybe the wifislax developer doesn't know about this issue.
If you like, please attach the warning from cap2hccapx (@skalderis) and the detailed warning from hcxpcapngtool:
Code:
$ hcxpcapngtool TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap
reading from TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap...
summary capture file
--------------------
file name................................: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 01.01.1970 01:00:00
timestamp maximum (GMT)..................: 01.01.1970 01:00:00
link layer header type...................: DLT_IEEE802_11 (105)
endianess (capture system)...............: little endian
packets inside...........................: 3
BEACON (total)...........................: 1
EAPOL messages (total)...................: 2
EAPOL RSN messages.......................: 2
ESSID (total unique).....................: 1
EAPOLTIME gap (measured maximum usec)....: 4999998
EAPOL ANONCE error corrections (NC)......: not detected
EAPOL M1 messages........................: 1
EAPOL M2 messages........................: 1
EAPOL pairs (total)......................: 1
EAPOL pairs (best).......................: 1
EAPOL M12E2..............................: 1
PMKID (total)............................: 1
PMKID (best).............................: 1
packets with zeroed timestamps...........: 3
Warning: missing frames!
This dump file contains no important frames like
authentication, association or reassociation.
That makes it hard to recover the PSK.
Warning: missing frames!
This dump file contains no undirected proberequest frames.
An undirected proberequest may contain information about the PSK.
That makes it hard to recover the PSK.
Warning: missing frames!
This dump file doesn't contain enough EAPOL M1 frames.
That makes it impossible to calculate nonce-error-correction values.
Warning: missing timestamps!
This dump file contains frames with zeroed timestamps.
That prevent calculation of EAPOL TIMEOUT values.
as well as the warning from wpapcap2john (JtR):
Code:
$ wpapcap2john -vv TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap
**
** Warning: TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap seems to be processed with some dubious tool like
** 'wpaclean'. Important information may be lost.
**
as well as the result from muticapconverter:
Code:
$ ./multicapconverter.py --input=TurkTelekom_ZPUY9-C8-54-4B-59-41-68.cap --export=hcwpax --all
[!] No Networks found
