|
Search Results
|
| Post |
Author |
Forum |
Replies
[asc]
|
Views |
Posted |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| The format of a 22000 hashline is:
Code:
--
SIGNATURE*TYPE*PMKID/MIC*MACAP*MACSTA*ESSID*ANONCE*EAPOL*MESSAGEPAIR
SIGNATURE = "WPA"
TYPE = 01 for PMKID, 02 for EAPOL, others to foll... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
03-15-2020, 11:51 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| Yes, you are right.
The BPF is a nice and fast kernel feature to filter out unwanted packets. You can combine everything (MAC_AP, MAC_CLIENT, rx branch, tx branch). The best way to use BPFC is to p... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
03-17-2020, 11:13 AM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| can be done by bash scripts, too.
Quick and dirty solution:
Code:
--
#!/bin/bash
while read -r line;
do
printf $line | awk 'BEGIN { FS = "*" } ; { printf $4 ":" }'
printf $line | awk '... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
03-27-2020, 09:53 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| hcxhashtool will do the job:
get example hash (22000) from here:
https://hashcat.net/wiki/doku.php?id=example_hashes
and run hcxhashtool to retrieve information
Code:
--
$ hcxhashtool -i ex... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
03-27-2020, 07:41 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| I changed naming from AP-LESS to ROGUE ATTACK, because the attack vector isn't AP-LESS or CLIENT-LESS. Instead hcxdumptool will act as a "ROGUE" ACCESS POINT for a CLIENT and as a ROGUE CLIENT for an ... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
05-12-2020, 04:56 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| We have an initial start value for MAC_AP and MAC_STA:
Code:
--
$ sudo hcxdumptool -i wlp39s0f3u3u1u2
initialization...
start capturing (stop with ctrl+c)
NMEA 0183 SENTENCE........: N/A
INTERFACE... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
05-13-2020, 08:42 AM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| No, because we have to stay much longer on the channel do do this.
Besides:
AUTHENTICATION REQUEST, AUTHENTICATION RESPONSE,
ASSOCIATION REQUEST, ASSOCIATIONREPONSE
(each of them followed by an AC... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
05-14-2020, 08:15 AM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| The whole filter stuff was refactored:
Now we have filtermode (0, 1, 2) in combination with filterlist_ap (ACCESS POINTs) and filterlist_client (CLIENTs).
That is much faster than filtering ACCESS P... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
05-23-2020, 01:59 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| hcxdumptool try to attack the ACCESS POINT (AP) by transmitting several requests and capture the whole traffic. That depend on the options, you selected.
If the AP respond to the requests, we retriev... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
06-24-2020, 12:37 PM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| That depend on the wireless driver (must support full monitor mode, full packet injection and ioctl() system calls).
At last the Atheros driver (ath9k) was completely broken:
https://bugzilla.kernel... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
07-23-2020, 08:18 AM |
| |
|
Thread: hcxtools - solution for capturing wlan traffic and conversion to hashcat formats
Post: RE: hcxtools - solution for capturing wlan traffic...
| Here you will get some good additional information:
https://www.siliceo.es/en/classification-of-the-best-chip-wifi-powerful-for-adapters-usb-features-and-compatibilities/
https://www.siliceo.es/en/t... |
|
ZerBea |
User Contributions
|
648 |
487,343 |
07-29-2020, 08:40 AM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA using PMKID
| Thanks for reporting this issue. I fixed it with the last commit.
We tried to use filterlist entries on the first outgoing broadcast packet. Since there are no incomming packets at this moment, we ru... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-05-2018, 10:53 AM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| Limitations:
This attack will not work on dynamic calculated PMKs.
You can identify them in your hash file:
MAC_AP, MAC_STA and ESSID are the same, PMKID changed.
In that case an EAPOL 4/4 handsha... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-08-2018, 12:23 PM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| And please do not wonder about "802.11q". We added this to the write-up, to see how many people simply copy from one another. So please, forgive us..... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-08-2018, 12:29 PM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| I got many issue reports on git regarding K*A*L*I.
For all K*A*L*I users, which are not penetration testers, please read this nice post here (remove the "*" inside the link):
https://unix.stackexch... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-14-2018, 08:32 AM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| Hi Kangaroot.
You're running an old version. Latest commit is v 4.2.1:
https://github.com/ZerBea/hcxdumptool/commit/95ef2951c5da7eec9d5469d43fc0851522a2d9d0
several bugfixes and new/changed options |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-14-2018, 11:02 PM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| Well, rolling release principle.... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-15-2018, 10:33 AM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| This bug was fixed last week! Do you use the latest commit? |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-15-2018, 07:57 PM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| Hi Kangaroot.
Forgot to answer to this:
Although, --enable-status now accepts only one of four options, not all of them as it used to.
-> No, now we use a bitmask.
- you can run --enable-status=1 ... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-15-2018, 08:00 PM |
| |
|
Thread: New attack on WPA/WPA2 using PMKID
Post: RE: New attack on WPA/WPA2 using PMKID
| That's interesting:
You received 4 PMKIDs for a single network (I assume that it isn't an ENTERPRISE network). So there must be 4 clients.
How is the commandline for hcxdumptool?
A hashfile shoul... |
|
ZerBea |
User Contributions
|
187 |
1,293,337 |
08-17-2018, 03:40 PM |
