DOCSEARCHbyAlgolia
Submit Docs

hcxtools

repository·master·Indexed 23 days ago

https://github.com/zerbea/hcxtools

A suite of specialized Linux tools for converting WiFi packet captures (pcapng, pcap, cap) into hash formats compatible with Hashcat and John the Ripper. The toolkit includes utilities such as hcxpcapngtool for conversion, hcxhashtool for filtering, and hcxpmktool for PSK/PMK verification, designed for security analysis of WiFi networks.

Tokens
1.3K
Snippets
1
Records
8
Agent score
32%

What's inside hcxtools

  1. Important usage notices and warnings

    master

    When using hcxtools, adhere to the following guidelines to ensure data integrity:

    • Do not merge dump files! Merging will destroy hash values assigned by custom blocks.
    • Output behavior: Most output files will be appended to existing files (except for pcapng, pcap, and cap files).
    • Hash Modes: It is recommended to use Hashcat mode 22000 (or 22001) instead of the deprecated 2500 (or 2501) and 16800 (or 16801).
    • Nonce Errors: The tools do not perform NONCE ERROR CORRECTIONS. If packet loss occurs, you may receive an incorrect PTK.
    • Analysis Focus: The tools are designed for analysis; they convert everything by default, so you must manually filter out unwanted information.

  2. Understand the hcxtools workflow

    master

    The standard workflow for converting WiFi packet captures into hashes for cracking involves a pipeline of tools:

    1. hcxdumptool: Capture the raw packets.
    2. hcxpcapngtool: Convert the raw capture files (pcapng, pcap, cap) into Hashcat and JtR readable formats.
    3. hcxhashtool: Filter the resulting hashes (optionally using hcxpsktool or hcxeiutool).
    4. hashcat or JtR: Perform the actual password cracking.

    Note: It is critical that the version of hcxpcapngtool always matches the version of hcxdumptool used in your workflow.

  3. Install hcxtools from source

    master

    To install the latest version of hcxtools, you must clone the repository and compile it using make. Ensure your distribution is up to date and all dependencies are installed.

    1. Clone the Repository

    git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools

    2. Compile and Install

    Build the tools using all available CPU cores:

    make -j $(nproc)

    Install to /usr/bin (as super user):

    make install

    Or install to /usr/local/bin (as super user):

    make install PREFIX=/usr/local
    git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make -j $(nproc)
make install
# or
make install PREFIX=/usr/local

  4. Review hcxtools system requirements

    master

    hcxtools is an advanced analysis toolkit and is not recommended for inexperienced users. It requires specific Linux environment configurations and technical knowledge.

    Operating System

    • Linux (latest long-term or stable kernel, mandatory >= 5.15).
    • Recommended Distributions: Arch Linux or OpenWRT (for small systems like Raspberry Pi/routers).

    Dependencies

    • Compiler: gcc >= 16 recommended.
    • Libraries:
      • libopenssl (>= 3.0) and openssl-dev.
      • librt and librt-dev (usually installed by default).
      • zlib and zlib-dev (required for gzip compressed files).
      • libcurl (>= 7.56) and curl-dev (required for whoismac and wlancap2wpasec).
    • Build Tools:
      • pkg-config.
      • make.

    Required Knowledge

    Users should have knowledge of:

    • Radio technology and electromagnetic-wave engineering.
    • 802.11 protocol and key derivation functions.
    • NMEA 0183 protocol.
    • Linux operating systems.

  5. Overview of hcxtools tools

    master
    hcxtools is a suite of small tools designed to convert WiFi capture packets into formats used to detect weak points in WiFi networks by analyzing hashes. The suite includes tools for conversion, filtering, calculation, and preparation of hashes for cracking tools like Hashcat and John the Ripper (JtR).

  7. Reference the hcxtools toolset

    master

    The hcxtools suite consists of several specialized utilities:

    ToolDescription
    hcxpcapngtoolConverts raw capture files to Hashcat and JtR readable formats.
    hcxhashtoolFilters hashes from HC22000 files based on user input.
    hcxpmktoolCalculates and verifies a PSK and/or a PMK.
    hcxpottoolHandles ASCII and various UTF formats of Hashcat's pot file.
    hcxpsktoolRetrieves weak PSK candidates from hash files or user input.
    hcxeiutoolPrepares -E -I -U output of hcxpcapngtool for Hashcat/JtR rules.
    hcxwltoolCalculates candidates for Hashcat and JtR based on mixed wordlists.
    hcxhash2capConverts hash files (PMKID&EAPOL, PMKID, EAPOL-hccapx, etc.) to .cap.
    wlancap2wpasecUploads multiple (gzip compressed) capture files to https://wpa-sec.stanev.org.
    whoismacShows vendor information and/or downloads OUI reference lists.

  8. List of hcxtools utilities and their functions

    master

    The following tools are part of the hcxtools suite:

    • hcxpcapngtool: Converts raw capture files to Hashcat and JtR readable formats.
    • hcxhashtool: Filters hashes from HC22000 files based on user input.
    • hcxpmktool: Calculates and verifies a PSK and/or a PMK.
    • hcxpottool: Handles ASCII and various UTF formats of Hashcat's pot file.
    • hcxpsktool: Extracts weak PSK candidates from hash files or user input.
    • hcxeiutool: Prepares hcxpcapngtool output (using -E, -I, -U flags) for use with Hashcat or JtR rules.
    • hcxwltool: Calculates candidates for Hashcat and JtR based on mixed wordlists.
    • hcxhash2cap: Converts various hash files (PMKID&EAPOL, PMKID, EAPOL-hccapx, EAPOL-hccap, WPAPSK-john) to .cap format.
    • wlancap2wpasec: Uploads multiple compressed (gzip) pcapng, pcap, and cap files to https://wpa-sec.stanev.org.
    • whoismac: Displays vendor information or downloads the OUI reference list.