zerbea / hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

These tools are 100% compatible with Hashcat and John the Ripper and are endorsed by Hashcat.

Brief Description

The main purpose of hcxtools is to detect weak points within one's own WiFi network by analyzing the hashes. Therefore, the conversion of the dump file to WPA-PBKDF2-PMKID+EAPOL hash file allows the user to check if the WLAN-KEY or PMK was transmitted unencrypted. Or upload the "uncleaned" dump file (pcapng, pcap, cap) here to find out if your AP or the CLIENT is vulnerable by using common wordlists or a weak password generation algorithm.

• Support for Hashcat hash-modes: 4800, 5500, 2200x, 16100, 250x (deprecated), and 1680x (deprecated).

• Support for John the Ripper hash-modes: WPAPSK-PMK, PBKDF2-HMAC-SHA1, chap, netntlm, and tacacs-plus.

• Support for gzip (.gz) single file compression.

An overview of Hashcat mode 22000. - (https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2)

Old but still applicable write-up by atom of the Hashcat forums covering a new attack on WPA/WPA2 using PMKID. - (https://hashcat.net/forum/thread-7717.html)

Hashcat mode 22000 write-up by atom of the Hashcat forums. - (https://hashcat.net/forum/thread-10253.html)

Unsupported: Windows OS, macOS, Android, emulators or wrappers!

What Don't hcxtools Do?

• They do not crack WPA PSK related hashes. (Use Hashcat or JtR to recover the PSK.)

• They do not crack WEP. (Use the aircrack-ng suite instead.)

• They do not crack WPS. (Use Reaver or Bully instead.)

• They do not decrypt encrypted traffic. (Use tshark or Wireshark to do so.)

Detailed Description

Tool	Description
hcxpcapngtool	Tool to convert raw capture files to Hashcat and JtR readable formats.
hcxhashtool	Tool to filter hashes from HC22000 files based on user input.
hcxpsktool	Tool to get weak PSK candidates from hash files or user input.
hcxpmktool	Tool to calculate and verify a PSK and/or a PMK.
hcxeiutool	Tool to prepare -E -I -U output of hcxpcapngtool for use by Hashcat + rule or JtR + rule.
hcxwltool	Tool to calculate candidates for Hashcat and JtR based on mixed wordlists.
hcxhash2cap	Tool to convert hash files (PMKID&EAPOL, PMKID, EAPOL-hccapx, EAPOL-hccap, WPAPSK-john) to cap.
wlancap2wpasec	Tool to upload multiple (gzip compressed) pcapng, pcap and cap files to https://wpa-sec.stanev.org
whoismac	Tool to show vendor information and/or download oui reference list.

Workflow

hcxdumptool -> hcxpcapngtool -> hcxhashtool (additional hcxpsktool/hcxeiutool) -> hashcat or JtR

Install Guide

On most distributions hcxtools are available through the package manager.

If you decide to compile latest git head, make sure that your distribution is updated to it's latest version and make sure that all header files and dependencies have been installed!

Clone Repository

---

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools

Compile & Install

---

make -j $(nproc)

Install to /usr/bin:

make install (as super user)

Or install to /usr/local/bin:

make install PREFIX=/usr/local (as super user)

Requirements

• Knowledge of radio technology.
• Knowledge of electromagnetic-wave engineering.
• Detailed knowledge of 802.11 protocol.
• Detailed knowledge of key derivation functions.
• Detailed knowledge of Linux
• Operating system: Linux (recommended: kernel >= 6.4, mandatory: kernel >= 5.10)
• Recommended: Arch Linux (notebooks and desktop systems), OpenWRT (small systems like Raspberry Pi, WiFi router)
• gcc >= 13 recommended (deprecated versions are not supported: https://gcc.gnu.org/)
• libopenssl (>= 3.0) and openssl-dev installed
• librt and librt-dev installed. (Should be installed by default.)
• zlib and zlib-dev installed. (For gzip compressed cap/pcap/pcapng files.)
• libcurl (>= 7.56) and curl-dev installed. (Used by whoismac and wlancap2wpasec.)
• pkg-config installed.

If you decide to compile latest git head, make sure that your distribution is updated to it's latest version!

Useful Scripts

Script	Description
piwritecard	Example script to restore SD-Card
piwreadcard	Example script to backup SD-Card
hcxgrep.py	Extract records from m22000 hashline/hccapx/pmkid file based on regexp

Notice

• Most output files will be appended to existing files (with the exception of pcapng, pcap, cap files).

• It is recommended to use hash mode 22000 (22001) instead of deprecated hash modes 2500 (2501) and 16800 (16801).

• hcxtools are designed to be analysis tools. This means that everything is converted by default and unwanted information must be filtered out!

Warning: Do not merge dump files! This WILL destroy hash values assigned by custom blocks!

• Tools do not perform NONCE ERROR CORRECTIONS! In case of a packet loss, you'll get a wrong PTK.

• This branch is pretty closely synced to the Hashcat and John the Ripper repositories.

Bitmask Message Pair Field (hcxpcapngtool)

bit 0-2

000 = M1+M2, EAPOL from M2 (challenge)

001 = M1+M4, EAPOL from M4 if not zeroed (authorized)

010 = M2+M3, EAPOL from M2 (authorized)

011 = M2+M3, EAPOL from M3 (authorized) - unused

100 = M3+M4, EAPOL from M3 (authorized) - unused

101 = M3+M4, EAPOL from M4 if not zeroed (authorized)

3: reserved

4: ap-less attack (set to 1) - no nonce-error-corrections necessary

5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary

6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary

7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

Warning

You might expect me to recommend that everyone should be using hcxdumptool/hcxtools. But the fact of the matter is, hcxdumptool/hcxtools is NOT recommended to be used by inexperienced users or newbies.

If you are not familiar with Linux in general or you do not have at least a basic level of knowledge as mentioned in section "Requirements", hcxdumptool/hcxtools is probably not what you are looking for. However, if you have that knowledge hcxdumptool/hcxtools can do magic for you.

The entire toolkit (hcxdumptool and hcxtools) is designed to be an analysis toolkit.

Useful Links

https://pcapng.com/

https://www.kernel.org/doc/html/latest/

https://www.kernel.org/doc/html/latest/bpf/index.html

https://www.freecodecamp.org/news/the-linux-commands-handbook/

https://en.wikipedia.org/wiki/Wpa2

https://en.wikipedia.org/wiki/802.11_Frame_Types

https://en.wikipedia.org/wiki/IEEE_802.11i-2004

hcxtools's Issues

musl compat

pls add

#include <endian.h>

to common.h

hcxtools/include/gzops.h not found

Hi. I've an error while trying to do "make" on hcxtools:
include/gzops.c:1:10: fatal error: zlib.h: Aucun fichier ou dossier de ce type
#include <zlib.h>
Need some help please. I'm using 4.18.0-kali3-amd64

hcxpcaptool command not found

infinite loop in hcxpcaptool

I've been playing around with honggfuzz and found a testcase causing hcxpcaptool to be stuck in an infinite loop.

Steps to reproduce:

$ cat loop.b64
Cg0NCmAAAABNPCsaAQAAAP//////////AgAGAHg4Nl82NAAAAwAYAExpbnV4IDUuMS41LWFyY2gx
LTItQVJDSAQAEQBoY3hkdW1wdG9vbCA1LjEuNQAAAAAAAABgAAAABQAAAAAAAAAAYAAAAAUAAAAA
AAAAAGAAAAAFAAAAKAAAAH8AAAD//wAAAgAJAHdscDBzMjB1MQAAAAAAAA==

$ base64 -d loop.b64 > loop.bin
$ ./hcxpcaptool -o /dev/null loop.bin

reading from loop.bin

This uses up 100% CPU and never ends.

hcxhash2cap.c:1026:39: error: ‘HCXP_HCCAP’ undeclared (first use in this function); did you mean ‘HCXP_HCCAPX’?

Got this when trying to build on an up to date Kali:

cc -O3 -Wall -Wextra -std=gnu99  -MMD -MF .deps/hcxhash2cap.d -o hcxhash2cap hcxhash2cap.c
hcxhash2cap.c: In function ‘main’:
hcxhash2cap.c:1026:39: error: ‘HCXP_HCCAP’ undeclared (first use in this function); did you mean ‘HCXP_HCCAPX’?
  {"hccap",   required_argument, NULL, HCXP_HCCAP},
                                       ^~~~~~~~~~
                                       HCXP_HCCAPX
hcxhash2cap.c:1026:39: note: each undeclared identifier is reported only once for each function it appears in
hcxhash2cap.c:1026:2: warning: missing initializer for field ‘val’ of ‘const struct option’ [-Wmissing-field-initializers]
  {"hccap",   required_argument, NULL, HCXP_HCCAP},
  ^
In file included from /usr/include/getopt.h:36,
                 from hcxhash2cap.c:2:
/usr/include/x86_64-linux-gnu/bits/getopt_ext.h:57:7: note: ‘val’ declared here
   int val;
       ^~~
make: *** [Makefile:82: hcxhash2cap] Error 1

not able to install hcxpcaptools

when i try to install the requirements of tools that is apt install libcurl4-openssl-dev libssl-dev zlib1g-dev libpcap-dev it shows error.

E: Could not get lock /var/lib/dpkg/lock-frontend - open (11: Resource temporarily unavailable)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is an other process using it?

hcxptools seems to break wifite

I am using the most recent nightly kernal 19.3 on net hunter nexus 6 android marshmallow. I can get wifite working find except when I install hcxptools. I have installed from apt install as well as direct git clone.

The issue comes after hcxptools is installed it puts wifite in a loop of deauthing a client and listening. I can never see any clients on the network even thought I know there are. It also never captures a handshake. However when I uninstall hcxptools wifite works fine. Any idea how to resolve this as I would like to be able to capture pmkids.

[Install] wlanhcx2cap.c:18:10: fatal error: curl/curl.h: No such file or directory

Hello, I have a little problem to install the tool on Parrot ( debian buster based)

sudo make cc -std=gnu99 -O3 -Wall -Wextra -o hcxpcaptool hcxpcaptool.c -lz -lcrypto cc -std=gnu99 -O3 -Wall -Wextra -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread cc -std=gnu99 -O3 -Wall -Wextra -o wlanhc2hcx wlanhc2hcx.c cc -std=gnu99 -O3 -Wall -Wextra -o wlanwkp2hcx wlanwkp2hcx.c cc -std=gnu99 -O3 -Wall -Wextra -o wlanhcxinfo wlanhcxinfo.c cc -std=gnu99 -O3 -Wall -Wextra -o wlanhcx2cap wlanhcx2cap.c -lpcap wlanhcx2cap.c:18:10: fatal error: curl/curl.h: No such file or directory #include <curl/curl.h> ^~~~~~~~~~~~~ compilation terminated. make: *** [Makefile:27: build] Error 1

Hope you can fix it soon : )

Using system-wide oui?

Hi!
I've prepared a patch for Debian for using system-wide ieee OUI, instead of depending on an internet connection (situations you may perfectly encounter when using hcxtools).

It would be great if you could have some sort of structure to default on a path, before using local user's home for it to download it. This would help drop this nasty nasty patch.

thanks in advance!

Index: hcxtools/whoismac.c
===================================================================
--- hcxtools.orig/whoismac.c
+++ hcxtools/whoismac.c
@@ -447,8 +447,9 @@ char *hexessidname = NULL;
 char *essidname = NULL;
 char *hash16800line = NULL;
 char *hash2500line = NULL;
+char *ouiname = NULL;
 const char confdirname[] = ".hcxtools";
-const char ouiname[] = ".hcxtools/oui.txt";
+
 
 while ((auswahl = getopt(argc, argv, "m:v:p:P:e:x:dh")) != -1)
        {
@@ -553,6 +554,15 @@ if(stat(confdirname, &statinfo) == -1)
 if(mode == 'd')
        downloadoui(ouiname);
 
+
+// Debian IEEE Data is present, using that...
+if(stat("/usr/share/ieee-data/oui.txt", &statinfo) == 0)
+{
+    ouiname = "/usr/share/ieee-data/oui.txt";
+}
+else
+    ouiname = ".hcxtools/oui.txt";
+
 if(stat(ouiname, &statinfo) != 0)
        {
        fprintf(stderr, "can't stat %s\n"
Index: hcxtools/wlanhcx2ssid.c
===================================================================
--- hcxtools.orig/wlanhcx2ssid.c
+++ hcxtools/wlanhcx2ssid.c
@@ -828,8 +828,8 @@ uid_t uid;
 struct passwd *pwd;
 FILE* fhoui;
 unsigned long long int vendoroui;
-
-const char ouiname[] = "/.hcxtools/oui.txt";
+struct stat statinfo;
+char *ouiname = NULL;
 
 char ouipathname[PATH_MAX +1];
 char linein[256];
@@ -842,6 +842,14 @@ if (pwd == NULL)
        exit(EXIT_FAILURE);
        }
 
+// Debian IEEE Data is present, using that...
+if(stat("/usr/share/ieee-data/oui.txt", &statinfo) == 0)
+{
+    ouiname = "/usr/share/ieee-data/oui.txt";
+}
+else
+    ouiname = ".hcxtools/oui.txt";
+
 strcpy(ouipathname, pwd->pw_dir);
 strcat(ouipathname, ouiname);

Performance bottleneck in addapstaessid

The algorithm here is accidentally N^2 with respect to pcap length and gets "slower and slower" as it continues to run.

-rw-r--r-- 1 clundquist clundquist  44G Aug  4 12:36 Kismet-20180709-18-35-12-1.pcapdump

start reading from /srv/wifi/Kismet-20180709-18-35-12-1.pcapdump
28100000 packets processed - be patient!
45900000 packets processed - be patient!
51500000 packets processed - be patient!
56300000 packets processed - be patient!
69700000 packets processed - be patient!
75700000 packets processed - be patient!
111000000 packets processed - be patient!
122000000 packets processed - be patient!
156200000 packets processed - be patient!
163500000 packets processed - be patient!
164600000 packets processed - be patient!

# top
29419 clundqu+  20   0   50412  35880   2436 R 100.0  0.1  68:48.60 hcxpcaptool                                                                                                                            

# sudo perf top
92.85%  hcxpcaptool              [.] addapstaessid                                                                                                                                                       

  4.68 │ 50:   lea    0x1(%rbp),%rax                                                                                                                                                                       ▒
  2.52 │       add    $0x36,%rbx                                                                                                                                                                           ▒
  3.62 │       cmp    %r12,%rax                                                                                                                                                                            ▒
       │     ↓ je     d0                                                                                                                                                                                   ▒
  5.79 │       mov    %rax,%rbp                                                                                                                                                                            ▒
  4.53 │ 60:   cmp    %r13b,0x15(%rbx)                                                                                                                                                                     ▒
 64.78 │     ↑ jne    50                                                                                                                                                                                   ▒
 12.21 │       mov    0x9(%rbx),%edi                                                                                                                                                                       ▒
  0.05 │       cmp    %edi,(%r8)                                                                                                                                                                           ▒
  1.39 │     ↑ jne    50   

The above disassembler appears to be this hot code path (I haven't recompiled with debug symbols to verify since I want to let the run finish).

2487   zeiger = apstaessidliste;
2488   for (c = 0; c < apstaessidcount; c++) {
2489     if ((essidlen == zeiger->essidlen) &&
2490         (memcmp(mac_ap, zeiger->mac_ap, 6) == 0) &&
2491         (memcmp(mac_sta, zeiger->mac_sta, 6) == 0) &&
2492         (memcmp(essid, zeiger->essid, zeiger->essidlen) == 0)) {
2493       zeiger->status |= status;
2494       return;
2495     }
2496     zeiger++;
2497   }

The algorithm here is roughly:

• Check if our global list is allocated
  • if it isn't allocated, make it now
• Check if the given node is our our list (linear search)
• If we didn't find it in our list realloc our list to 1 size bigger to make room (expensive as our list grows)
• Assign our newest node at the end of the list

This boils down to "Find or Create".

We should update this algorithm to something closer to:

• On start allocate our collection (to remove the branch from a hot code path)
• use bsearch for the node
  • If we find the node, we're done
• Check if the collection has room (size == capacity)
  • If we don't have room, allocate more slots, grow by perhaps max(8, capacity / 4), update our capacity
• If we don't find the node append it (ideally we would want an insertion sort)
• qsort (ideally insertion would be better) the collection so that bsearch works next call

Alternatively we could use a tree tsearch and friends, but iterating gets a little more complicated.

wlanhcx2cap.c:19:10: fatal error: curl/curl.h:

Error message on compile:
wlanhcx2cap.c:19:10: fatal error: curl/curl.h:

hcxpcaptool -

Hello, I've got this problem on Debian:

$ ./hcxpcaptool -h
./hcxpcaptool: error while loading shared libraries: libcrypto.so.1.1:
cannot open shared object file: No such file or directory

$ which openssl
/usr/bin/openssl

$ ldd /usr/bin/openssl
        linux-vdso.so.1 (0x00007ffecb54a000)
        libssl.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f7ec1fc0000)
        libcrypto.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0x00007f7ec1bc3000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f7ec19bf000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f7ec1614000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f7ec2221000)

Is version 1.1 of libcrypto mandatory ? Or 1.0.0 can work ? If yes, how to configure the makefile ?
Thank you.

fatal error: openssl/sha.h: No such file or directory

I tried make and make install but i got this error

cc -O3 -Wall -Wextra -std=gnu99 -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
hcxpcaptool.c:16:10: fatal error: openssl/sha.h: No such file or directory
#include <openssl/sha.h>
^~~~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:23: build] Error 1

Feature request - hcxpcaptool output to PMK : ESSID?

Feature request?

hcxpcaptool exports PMK list thanks to -P option, while wlanpmk2hcx tool requires as input a combo list PMK:ESSID
i <file> : input combilist (pmk:essid)

Any chance hcxpcaptool could output as PMK : ESSID?

Final goal: cap -> PMK extract -> sha1 hash (mode 12000)

Compiling error. (OpenWRT ar71xx MIPSBE)

Hi, looks like latest commits caused some issues when compiling for some systems.

I'm compiling for the WiFi Pineapples. (ar71xx CPU / MIPS-BE).
I noticed some updates lately regarding endianess, that's why i'm referencing what system i'm compiling for.

Here's the error message:

mips-openwrt-linux-uclibc-gcc -Os -pipe -mno-branch-likely -mips32r2 -mtune=34kc -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -mips16 -minterlink-mips16  -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto 
hcxpcaptool.c: In function 'processpcapng':
hcxpcaptool.c:5684:2: error: expected ';' before 'if'
  if(blocktype == PCAPNGBLOCKTYPE)
  ^
make[3]: *** [Makefile:79: hcxpcaptool] Error 1

When you run the program wifite, I wrote an error that I need to download additional packages. Kali linux

I downloaded the package, but the installation I write error 1. What should I do in such situations ? I will give a link to the video : https://youtu.be/rQ78sVEFCtY

is to possible to generate the PMKID from a cap file if the m1 doesn't contain the RSN PMKID ?

i have a cap file that contains all the 4 way messages !
but it doesn't contain the RSN PMKID ..
is it possible to generate it manually ?!!!

why the rsn is zeros ?

error when i make or make install please help

mkdir -p .deps
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
In file included from hcxpcaptool.c:36:
include/gzops.c:1:10: fatal error: zlib.h: No such file or directory
#include <zlib.h>
^~~~~~~~
compilation terminated.
make: *** [Makefile:79: hcxpcaptool] Error 1

hcxpcaptool outfile issue?

Hello,

hcxpcaptool seems to read PMKIDs in my pcap, but doesn't write the outfile. Am I missing something?

me@HOST:~$ sudo hcxpcaptool -V -z handshakes.pmkid *.pcap

reading from handshakes.pcap
                                                
summary:                                        
--------
file name....................: handshakes.pcap
file type....................: pcap 2.4
file hardware information....: unknown
file os information..........: unknown
file application information.: unknown
network type.................: DLT_IEEE802_11_RADIO (127)
endianness...................: little endian
read errors..................: flawless
packets inside...............: 11
skipped packets..............: 0
packets with GPS data........: 0
packets with FCS.............: 11
EAPOL packets (total)........: 11
EAPOL packets (WPA2).........: 11
EAPOL PMKIDs (total).........: 11
EAPOL PMKIDs (WPA2)..........: 11
best PMKIDs..................: 2

Then there is no outfile, I've tried messing with the different outputs, nothing each time.

Raspberry pi terminates wlandump-ng

Hello,
I am trying to use the tool "wlandumg-ng" to scan channel 6 of the surrounding wifi networks using the following command:

sudo wlandump-ng -i wlan0 -c 6 -o test.cap

After only a few seconds, the output on the terminal says, that the programm was "terminated..."
Any Ideas, what I am missing?
I am using a raspberry pi 3B+ with the ubuntu mate operating system. To enter the monitoring mode, I used the tool "makemonbb" from the "usefulscripts" folder. The output of that command is as follows:

select WLAN interface: wlan0
deactivating NetworkManager and wpa_supplicant
Failed to stop NetworkManager.service: Unit NetworkManager.service not loaded.
activating monitor mode on wlan0
command failed: Operation not supported (-95)
Interface wlan0
	ifindex 3
	wdev 0x1
	addr b8:27:eb:30:42:63
	type managed
	wiphy 0
	channel 34 (5170 MHz), width: 20 MHz, center1: 5170 MHz
	txpower 31.00 dBm

Seems like it fails to stop the Network manager. Any ideas how I can fix this?

Cheers

fatal error: openssl/sha.h: No such file or directory

make
cc -O3 -Wall -Wextra -std=gnu99 -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
hcxpcaptool.c:16:10: fatal error: openssl/sha.h: No such file or directory
#include <openssl/sha.h>
^~~~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:23: build] Error 1

fatal error: zlib.h: No such file or directory

Running make when in the hcxtools directory I get an error
Include/gzops.c:1:10: fatal error: zlib.h: No such file or directory
#include <zlib.h>

hcxpcaptool -z works | -j doesn't work

$ hcxpcaptool -z output.16800 input.pcapng
reading from 24032019.pcapng

summary:
--------
[...]
1 PMKID(s) written to output.16800

It works.

$ hcxpcaptool -j output.john input.pcapng
reading from 24032019.pcapng

summary:
--------
[...]

I haven't output.john. Same with -J

I'am on raspberry (1st model) hcxpcaptool 5.1.4 compiled from git

[Request] hcxtools in Debian repositories

It would be nice to have hcxtools and hcxdumptool in Debian repositories.

All packages from the Debian Testing repository are automatically and regularly imported into the Kali Linux repository, so it would be easy to install (and maintain the latest version of) hcx on Debian and Kali Linux (and also on some other distros) using just apt install hcxtools.

[Install] wlanhcx2cap.c:12:10: fatal error: pcap.h: No such file or directory

when i try and do a make i get the following

`cc -std=gnu99 -O3 -Wall -Wextra -o hcxpcaptool hcxpcaptool.c -lz -lcrypto

cc -std=gnu99 -O3 -Wall -Wextra -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread

cc -std=gnu99 -O3 -Wall -Wextra -o wlanhc2hcx wlanhc2hcx.c

cc -std=gnu99 -O3 -Wall -Wextra -o wlanwkp2hcx wlanwkp2hcx.c

cc -std=gnu99 -O3 -Wall -Wextra -o wlanhcxinfo wlanhcxinfo.c

cc -std=gnu99 -O3 -Wall -Wextra -o wlanhcx2cap wlanhcx2cap.c -lpcap

wlanhcx2cap.c:12:10: fatal error: pcap.h: No such file or directory

#include <pcap.h>

      ^~~~~~~~

compilation terminated.

Makefile:22: recipe for target 'build' failed

make: *** [build] Error 1

`
I've already installed

libssl-dev
libcurl4-gnutls-dev 
libcurl4-openssl-dev 

none of them resolved this using Kali

macOS build warnings

Haven't had time to dig into it myself.

In file included from hcxpcaptool.c:35:
./include/gzops.c:29:19: warning: missing field 'avail_in' initializer
      [-Wmissing-field-initializers]
z_stream strm = {0};
                  ^
hcxpcaptool.c:3093:70: warning: too many arguments in call to 'process80211reassoc_resp'
                process80211reassoc_resp(tv_sec, tv_usec, caplen, wdsoffset, packet);
                ~~~~~~~~~~~~~~~~~~~~~~~~                                           ^
2 warnings generated.

How to imporve this problem of kali linux?

hcxpcaptool.c:16:10: fatal error: openssl/sha.h

Issue cross-compiling (OpenWRT)

I've been trying to keep hcxdumptool and hcxtools up to date for OpenWRT with your commits, but something broke with commit bb7623e (according to bisect, and manual compilations)
Seems to be related to endianess.
Error message:

ccache_cc -Os -pipe -mno-branch-likely -mips32r2 -mtune=34kc -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -mips16 -minterlink-mips16  -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
In file included from hcxpcaptool.c:37:0:
include/hashcatops.c: In function 'writehccaprecord':
include/hashcatops.c:99:6: error: 'hccap_t' has no member named 'eapolsize'
 hccap.eapolsize = byte_swap_16(hccap.eapolsize);
      ^
include/hashcatops.c:99:37: error: 'hccap_t' has no member named 'eapolsize'
 hccap.eapolsize = byte_swap_16(hccap.eapolsize);
                                     ^
In file included from hcxpcaptool.c:38:0:
include/johnops.c: In function 'writejohnrecord':
include/johnops.c:103:6: error: 'hccap_t' has no member named 'eapolsize'
 hccap.eapolsize = byte_swap_16(hccap.eapolsize);
      ^
include/johnops.c:103:37: error: 'hccap_t' has no member named 'eapolsize'
 hccap.eapolsize = byte_swap_16(hccap.eapolsize);
                                     ^
hcxpcaptool.c: At top level:
hcxpcaptool.c:42:0: warning: "BIG_ENDIAN_HOST" redefined [enabled by default]
 #define BIG_ENDIAN_HOST
 ^
In file included from include/ieee80211.c:1:0,
                 from hcxpcaptool.c:30:
include/ieee80211.h:109:0: note: this is the location of the previous definition
 #define BIG_ENDIAN_HOST 1
 ^
make[3]: *** [Makefile:82: hcxpcaptool] Error 1

compilation error curl

i am using Kali Linux "4.19.0-kali5-amd64"

lsb_release -a:
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2019.2
Codename: n/a

while trying to install libcurl3

i am getting :

Package libcurl3 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
libcurl4

E: Package 'libcurl3' has no installation candidate

I have the latest libcurl4 is there a workaround?

problem to convert the pcapng and write the hash in a file nothing happened

I have a problem with hcxpcaptool , i can read the packet , i have the pmkids but
i cannot convert into a 16800 hash and write it in a file , nothing happened , but with the -Z command for 16801 hash it works ...
i use the last version and my os is ubuntu .
thx for your help

:~/hcxtools-master# ./hcxpcaptool -z test.16800 pmkid.pcapng
start reading from pmkid.pcapng

summary:

file name....................: pmkid.pcapng
file type....................: pcapng 1.0
file hardware information....: Intel(R) Core(TM) iX CPU X XXX @ X.XXGHz (with SSE4.2)
file os information..........: Linux 4.15.0-33-generic
file application information.: Dumpcap (Wireshark) 2.4.5 (Git v2.4.5 packaged as 2.4.5-1)
network type.................: DLT_EN10MB (1)
endianess....................: little endian
read errors..................: flawless
packets inside...............: 16
skipped packets..............: 0
packets with FCS.............: 0
EAPOL packets................: 17
EAPOL PMKIDs.................: 1

If i use -Z command it works ...

:~/hcxtools-master# ./hcxpcaptool -Z test.16800 pmkid.pcapng
start reading from pmkid.pcapng

summary:

file name....................: pmkid.pcapng
file type....................: pcapng 1.0
file hardware information....: Intel(R) Core(TM) iX CPU X XXX @ X.XXGHz (with SSE4.2)
file os information..........: Linux 4.15.0-33-generic
file application information.: Dumpcap (Wireshark) 2.4.5 (Git v2.4.5 packaged as 2.4.5-1)
network type.................: DLT_EN10MB (1)
endianess....................: little endian
read errors..................: flawless
packets inside...............: 16
skipped packets..............: 0
packets with FCS.............: 0
EAPOL packets................: 17
EAPOL PMKIDs.................: 1

1 PMKID(s) written to test.16800

Issue with Curl.h

I have curl installed on my machine and I am receiving this error:

cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcx2cap.d -o wlanhcx2cap wlanhcx2cap.c -lpcap wlanhcx2cap.c:19:10: fatal error: curl/curl.h: No such file or directory #include <curl/curl.h> ^~~~~~~~~~~~~ compilation terminated. make: *** [Makefile:79: wlanhcx2cap] Error 1

Am I missing something?

fatal error: openssl/sha.h: No such file or directory

root@KALI:/hcxtools# make
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
hcxpcaptool.c:16:10: fatal error: openssl/sha.h: No such file or directory
#include <openssl/sha.h>
^~~~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:79: hcxpcaptool] Error 1
root@KALI:/hcxtools# make install
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
hcxpcaptool.c:16:10: fatal error: openssl/sha.h: No such file or directory
#include <openssl/sha.h>
^~~~~~~~~~~~~~~
compilation terminated.
make: *** [Makefile:79: hcxpcaptool] Error 1

fatal error: curl/curl.h: No such file or directory

root@kali:~/hcxtools# make
cc -O3 -Wall -Wextra -std=gnu99 -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
cc -O3 -Wall -Wextra -std=gnu99 -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread
cc -O3 -Wall -Wextra -std=gnu99 -o wlanhc2hcx wlanhc2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -o wlanwkp2hcx wlanwkp2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -o wlanhcxinfo wlanhcxinfo.c
cc -O3 -Wall -Wextra -std=gnu99 -o wlanhcx2cap wlanhcx2cap.c -lpcap
wlanhcx2cap.c:19:10: fatal error: curl/curl.h: No such file or directory
#include <curl/curl.h>
^~~~~~~~~~~~~
compilation terminated.
Makefile:23: recipe for target 'build' failed
make: *** [build] Error 1

[Request] Cap2John

I'm trying to streamline an "automated" mobile cracking box and could really use a binary to convert directly to John format. Would also be extremely nice to have an option to output directly to STDOUT.

HcxTools > cap2john > mdxfind -f small.wordlist = Ton-o-Fun

I just lack the coding knowledge to make it happen.

openssl/sha.h: No such file or directory

"make" fails - pcap.h: No such file or directory

I can't seem to run make.

wlanhcx2cap.c:12:18: fatal error: pcap.h: No such file or directory
#include <pcap.h>
^
compilation terminated.
Makefile:79: recipe for target 'wlanhcx2cap' failed
make: *** [wlanhcx2cap] Error 1

pcap.h doesn't appear in the directory hcxtools, where can I find it?

Compilation Terminated

curl/curl.h no such file or directory fatal error
im using kali linux 2019.3

mbedTLS support

In OpenWrt, mbedTLS is used for libcurl as the default provider for TLS for size reasons. However with hcxtools, libopenssl must be present as well. This presents a challenge for flash size limited routers. Here are some sizes: https://downloads.openwrt.org/snapshots/packages/arc_arc700/base/

libmbedtls12_2.16.2-1_arc_arc700.ipk | 156.1 KB
libopenssl1.1_1.1.1c-1_arc_arc700.ipk | 855.6 KB

As far as I can tell, the only missing piece for mbedTLS is that CMAC is disabled by default. It can be compile time enabled.

libopenssl is faster, yes, but I don't think speed is important here.

sort_apstaessidlist_by_ap_sta undeclared

mkdir -p .deps cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto hcxpcaptool.c: In function ‘cleanapstaessid’: hcxpcaptool.c:2537:62: error: ‘sort_apstaessidlist_by_ap_sta’ undeclared (first use in this function); did you mean ‘sort_apstaessidlist_by_ap_essid’? qsort(apstaessidliste, apstaessidcount, APSTAESSIDLIST_SIZE, sort_apstaessidlist_by_ap_sta); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sort_apstaessidlist_by_ap_essid hcxpcaptool.c:2537:62: note: each undeclared identifier is reported only once for each function it appears in
in file:
qsort(apstaessidliste, apstaessidcount, APSTAESSIDLIST_SIZE, sort_apstaessidlist_by_ap_sta);
need:
qsort(apstaessidliste, apstaessidcount, APSTAESSIDLIST_SIZE, sort_apstaessidlist_by_ap_sta_essid);

hcxpcaptool.c:3400: error: ‘PATH_MAX’ undeclared (first use in this function)

Tried to build on CentOS 6.9 with both gcc 4.4.7 and 7.2.1:

gcc 4:

gcc -std=gnu99 -O3 -Wall -Wextra -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
In file included from hcxpcaptool.c:32:
include/gzops.c: In function ‘decompressgz’:
include/gzops.c:29: warning: missing initializer
include/gzops.c:29: warning: (near initialization for ‘strm.avail_in’)
hcxpcaptool.c: In function ‘processcapfile’:
hcxpcaptool.c:3400: error: ‘PATH_MAX’ undeclared (first use in this function)
hcxpcaptool.c:3400: error: (Each undeclared identifier is reported only once
hcxpcaptool.c:3400: error: for each function it appears in.)
hcxpcaptool.c:3400: warning: unused variable ‘tmpoutname’
make: *** [build] Error 1

gcc 7:

hcxpcaptool.c: In function ‘processcapfile’:
hcxpcaptool.c:3400:17: error: ‘PATH_MAX’ undeclared (first use in this function); did you mean ‘AF_MAX’?
 char tmpoutname[PATH_MAX+1];
                 ^~~~~~~~
                 AF_MAX
hcxpcaptool.c:3400:17: note: each undeclared identifier is reported only once for each function it appears in
hcxpcaptool.c:3400:6: warning: unused variable ‘tmpoutname’ [-Wunused-variable]
 char tmpoutname[PATH_MAX+1];
      ^~~~~~~~~~
make: *** [build] Error 1

Defining PATH_MAX 255 resolves the issue.

whoismac.c:49:23: error: ‘CURLOPT_TCP_KEEPALIVE’ undeclared (first use in this function); did you mean ‘CURLOPT_COOKIELIST’?

Tried to build on CentOS 6.9 with gcc 7.2.1 and libcurl-devel-7.19.7-53.el6_9.x86_64:

gcc -std=gnu99 -O3 -Wall -Wextra -o whoismac whoismac.c -lcurl
In file included from /usr/include/curl/curl.h:1933:0,
                 from whoismac.c:18:
whoismac.c: In function ‘downloadoui’:
whoismac.c:49:23: error: ‘CURLOPT_TCP_KEEPALIVE’ undeclared (first use in this function); did you mean ‘CURLOPT_COOKIELIST’?
 curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
                       ^
whoismac.c:49:23: note: each undeclared identifier is reported only once for each function it appears in
make: *** [build] Error 1

Commenting out line 49 resolves it.

Fatal error while trying to compile

root@kali:~/hcxtools# make
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
hcxpcaptool.c:16:10: fatal error: openssl/sha.h: No such file or directory
#include <openssl/sha.h>
^~~~~~~~~~~~~~~
compilation terminated.
Makefile:79: recipe for target 'hcxpcaptool' failed
make: *** [hcxpcaptool] Error 1

fatal error: openssl/sha.h: No such file or directory

[cosmetics] install invokes unnecessary second build

Hello,
thanks for the tool.
as "install" has dependency "build" invoking install also always invokes the build even when it is necessary. The usual combo will result in build being executed twice:

make build
make install

Instead the "install" should be depending on the products of the "build", the targets of the compilation.

Best regards
Michal Ambroz

Hcxpcaptools -z cannot output any files

When I attack the wpa2 wifi ,I use hcxpcaptool -z test.16800 test.pcapng
.but nothing output. At the same time
if I use hcxpcaptools -o test.16800 test.pcapng ,it can out put something... But I need the use 16800 model of hashcat... help

hx

heres what my my capture looks like and the first two captures are from my router the second two are not is this normal? anyway when i turn the pmkid into hash and try to crack it.. hashcat gives me password from wrong access point.
hcxdumptool -o hashingit -i wlan0 --filterlist=tvfp2filer.txt --filtermode=2 --enable_status 1 start

capturing (stop with ctrl+c) INTERFACE:...............: wlan0
FILTERLIST...............: 1 entries
MAC CLIENT...............: fcc233dadfba
MAC ACCESS POINT.........: b025aa99a8f8 (incremented on every new client) EAPOL TIMEOUT............: 150000
REPLAYCOUNT..............: 63156
ANONCE...................: 1f963f900448da8c1182e40ba288928877f40543759cd5e6425deb3548407868 [16:26:17 - 001] 009fa9073914 -> 5c93a20b3897 [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2516]
[16:40:15 - 001] 009fa9073914 -> ccfb65942f7e [FOUND AUTHORIZED HANDSHAKE, EAPOL TIMEOUT 2651] [17:19:39 - 001] b44bd20fd6ba -> 5c8fe0bf2984 [EAPOL 4/4 - M4 RETRY ATTACK] [17:39:53 - 011] 2c56dc54e238 -> 5ccf7f48a404 [FOUND PMKID] INFO: cha=11, rx=145350, rx(dropped)=3145, tx=2453, powned=3, err=0^C terminated... the filter is working somewhat atleast cuz i tried without filter and got slammed with tons more

wlanhcx2cap.c

root@kali:~/Downloads/hcxtools-master# sudo make
mkdir -p .deps
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpcaptool.d -o hcxpcaptool hcxpcaptool.c -lz -lcrypto
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxpsktool.d -o hcxpsktool hcxpsktool.c -lcrypto
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxhashcattool.d -o hcxhashcattool hcxhashcattool.c -lcrypto -lpthread
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/hcxhash2cap.d -o hcxhash2cap hcxhash2cap.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhc2hcx.d -o wlanhc2hcx wlanhc2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanwkp2hcx.d -o wlanwkp2hcx wlanwkp2hcx.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcxinfo.d -o wlanhcxinfo wlanhcxinfo.c
cc -O3 -Wall -Wextra -std=gnu99 -MMD -MF .deps/wlanhcx2cap.d -o wlanhcx2cap wlanhcx2cap.c -lpcap
wlanhcx2cap.c:76:28: error: unknown type name ‘pcap_dumper_t’; did you mean ‘pcap_hdr_t’?
static void pcapwritepaket(pcap_dumper_t *pcapdump, hcx_t *zeigersend)
^~~~~~~~~~~~~
pcap_hdr_t
wlanhcx2cap.c: In function ‘writecap’:
wlanhcx2cap.c:270:1: error: unknown type name ‘pcap_dumper_t’; did you mean ‘pcap_hdr_t’?
pcap_dumper_t *pcapdump;
^~~~~~~~~~~~~
pcap_hdr_t
wlanhcx2cap.c:271:1: error: unknown type name ‘pcap_t’; did you mean ‘eap_t’?
pcap_t *pcapdh;
^~~~~~
eap_t
wlanhcx2cap.c:291:12: warning: implicit declaration of function ‘pcap_open_dead’ [-Wimplicit-function-declaration]
pcapdh = pcap_open_dead(DLT_IEEE802_11, 65535);
^~~~~~~~~~~~~~
wlanhcx2cap.c:291:10: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
pcapdh = pcap_open_dead(DLT_IEEE802_11, 65535);
^
wlanhcx2cap.c:292:18: warning: implicit declaration of function ‘pcap_dump_open’ [-Wimplicit-function-declaration]
if((pcapdump = pcap_dump_open(pcapdh, pcapoutstr)) != NULL)
^~~~~~~~~~~~~~
wlanhcx2cap.c:292:16: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
if((pcapdump = pcap_dump_open(pcapdh, pcapoutstr)) != NULL)
^
wlanhcx2cap.c:294:4: warning: implicit declaration of function ‘pcapwritepaket’ [-Wimplicit-function-declaration]
pcapwritepaket(pcapdump, zeiger);
^~~~~~~~~~~~~~
wlanhcx2cap.c:296:4: warning: implicit declaration of function ‘pcap_dump_close’ [-Wimplicit-function-declaration]
pcap_dump_close(pcapdump);
^~~~~~~~~~~~~~~
wlanhcx2cap.c: In function ‘writesinglecap’:
wlanhcx2cap.c:329:1: error: unknown type name ‘pcap_dumper_t’; did you mean ‘pcap_hdr_t’?
pcap_dumper_t *pcapdump;
^~~~~~~~~~~~~
pcap_hdr_t
wlanhcx2cap.c:330:1: error: unknown type name ‘pcap_t’; did you mean ‘eap_t’?
pcap_t *pcapdh;
^~~~~~
eap_t
wlanhcx2cap.c:332:8: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
pcapdh = pcap_open_dead(DLT_IEEE802_11, 65535);
^
wlanhcx2cap.c:333:14: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
if((pcapdump = pcap_dump_open(pcapdh, singlecapoutname)) == NULL)
^
At top level:
wlanhcx2cap.c:29:31: warning: ‘getreplaycount’ defined but not used [-Wunused-function]
static unsigned long long int getreplaycount(uint8_t *eapdata)
^~~~~~~~~~~~~~
Makefile:82: recipe for target 'wlanhcx2cap' failed
make: *** [wlanhcx2cap] Error 1

fatal error: openssl/sha.h: No such file or directory

not able to install

not able to perform make, trying on the below:
Linux version 4.14.0-kali3-amd64 ([email protected]) (gcc version 7.2.0 (Debian 7.2.0-18)) #1 SMP Debian 4.14.12-2kali1 (2018-01-08)

result:

~/Desktop/WIFI/Hashcat/hcxtools# make gcc -std=gnu99 -O3 -Wall -Wextra -o wlandump-ng wlandump-ng.c -lpcap -lrt wlandump-ng.c:23:10: fatal error: pcap.h: No such file or directory #include <pcap.h> ^~~~~~~~ compilation terminated. Makefile:34: recipe for target 'build' failed make: *** [build] Error 1

output file for hcxpcaptools is no where to be found

hello I installed the tool today and when testing I was not able to crate an output file. i was attempting to use the following

$ hcxpcaptools -z hacktocrack hash
$ hcxpcaptools -z hacktocrack.txt hash
$ sudo hcxpcaptools -z hacktocrack hash

after checking the directory, root directory and using
$ locate hashtocrack
and I was still not able to find the files. I also attempted to use make and Make install but had not success. I hope you can help me resolve my problem with the tool