Convert pcapng to hc22000 in Kali Linux for Hashcat

[xhassanex]

i run cmd : hcxpcapngtool -o hash.hc22000 -E essidlist TESTFILE.pcapng

but i cant find hashcatfile : hash.hc22000

[ZerBea]

First make sure the dump file is on your working directory:

$ pwd
/tmp/workingdirectory

$ ls
TESTFILE.pcapng

$ hcxpcapngtool -o hash.hc22000 -E essidlist TESTFILE.pcapng
hcxpcapngtool 6.3.5-56-g3e20e17 reading from TESTFILE.pcapng...

summary capture file
--------------------
file name................................: TESTFILE.pcapng
...
EAPOL pairs (total)......................: 176
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file...: 1 (RC checked)
EAPOL M12E2 (challenge)..................: 1

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2457: 2676	


session summary
---------------
processed pcapng files................: 1

$ ls
essidlist  hash.hc22000  TESTFILE.pcapng

The important part of the status message is this:
EAPOL pairs written to 22000 hash file...: 1 (RC checked)

If you don't see something like that (in case of an EAPOL MESSAGE PAIR) or that (in case of a PMKID):
RSN PMKID written to 22000 hash file.....: 1
your dump file doesn't contain enough data to convert and there is no hc22000 file.

Unfortunately posting a command line only is not enough information to help you.

[xhassanex]

But I did this first cmd :
sudo hcxdumptool -i wlan0 -w TESTFILE.pcapng -F --rds=1

it work ? thanks for ur time

[ZerBea]

Running option -F the entire frequency range of the device is scanned. That takes much time until you get a PMKID or a MESSAGE PAIR.

hcxdumptool -h:
                    columns:
                      E = encryption (e)ncrypted / (o)pen
                      A = AKM (p)re-shared key
                      1 = received M1
                      2 = received M1M2
                      3 = received M1M2M3
                      P = received PMKID

If you don't see a "+" in column 2,3 or P nothing is captured.

If you run hcxpcapngtool on the dump file and you don't see
EAPOL pairs written to 22000 hash file...: 1 (RC checked)
or
RSN PMKID written to 22000 hash file.....: 1
there is nothing to convert to a hc22000 file.

[xhassanex]

thank u very much for ur help it work now with little of data and time i do cmd
3,P
sudo hcxdumptool -i wlan0 -w TESTFILE1.pcapng --rds=3,P -F

[xhassanex]

please can u help me again i cant find (--do_rcascan) what i can do in her palce ?

sudo hcxpcapngtool --rcascan=active -i wlan0

[ZerBea]

This (--rds=3,P) is not a valid option.
In the best case, this faulty option will be ignored. In worst case hcxdumptool is doing something that you don't expect.
Please see -h for all valid options and --help for additional options.

A detailed how-to is here (including all command line options to reproduce it):
#493