arsenal/hcxdumptool

hcxdumptool

WPA/PMKID capture · MIT

The modern way to capture WPA material. It grabs PMKIDs and handshakes efficiently, often without needing a connected client, and writes a file ready for conversion and cracking.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01PMKID versus the four-way handshake

The classic WPA attack needs a client to connect so you can catch the four-way handshake, which is why aircrack-ng often pairs capture with a deauth. The PMKID attack is different: many access points volunteer a PMKID in the very first message of association, so a single frame from the AP itself can be enough. No client, no deauth, no waiting. hcxdumptool is the tool built to collect this at scale, which is exactly what makes it the wardriving workhorse.

» Captures PMKIDs directly from access points that offer them, client-free.

» Still captures full four-way handshakes when clients are present.

» Works across many networks at once while you move, rather than one target at a time.

» Writes a pcapng that hcxtools converts straight to a hashcat 22000 hash.

02Install and prepare the card

hcxdumptool is often newer than the version in your distro, and its options have changed between major releases. Install it, then always confirm the exact flags with its help, because v6 and later renamed several options and removed the old active-attack flags in favour of safer defaults.

$ sudo emerge net-wireless/hcxdumptool # Gentoo

$ sudo apt install hcxdumptool # Debian / Ubuntu / Kali

$ sudo dnf install hcxdumptool # Fedora

» The commands below use a common form. If a flag is rejected, check --help for your version; the concepts are stable even when the letters move. hcxdumptool manages monitor mode itself on recent versions, so you point it at wlan0 directly.

↑ contents

03A basic capture

Point hcxdumptool at your interface and give it an output file. It hops channels, solicits PMKIDs, and records everything of value. The live status shows what it is catching as it runs.

$ sudo hcxdumptool -i wlan0 -w dump.pcapng --enable_status=3

» Each FOUND line is usable material. PMKID entries came with no client involved; the handshake line caught a real association. Stop with ctrl+c and you have dump.pcapng.

04Stay in scope with a filter

For authorised testing you often want to capture only your own networks and ignore everything else in the air. hcxdumptool takes a filter list of BSSIDs so it only works the targets you name. This is the responsible default for any real assessment: scope it to what you own.

$ printf 'AA:BB:CC:11:22:33\nDE:AD:BE:EF:00:02\n' > myaps.txt

$ sudo hcxdumptool -i wlan0 -w dump.pcapng --filterlist_ap=myaps.txt --filtermode=2 --enable_status=3

» With filtermode set to attack-only-the-listed, hcxdumptool leaves your neighbours alone and concentrates on the access points you are allowed to test. Keep this list tight; it is your proof of scope.

A filter list is not just convenience, it is how you keep a capture lawful and clean. Capturing the whole street because it was easier is the kind of overreach that turns a hardening exercise into an offence.

05Capture with GPS for wardriving

For a mapping drive, add GPS so each capture is located. hcxdumptool reads from gpsd or a serial device and stamps the records, giving you both the crackable material and the map in one pass.

$ sudo gpsd /dev/ttyACM0 -F /var/run/gpsd.sock

$ sudo hcxdumptool -i wlan0 -w drive.pcapng --gpsd --nmea=drive.nmea --enable_status=3

» The .nmea track plus the capture is everything the wardriving guide needs to build a coverage map and a hardening report for your own sites.

↑ contents

06Convert and crack

hcxdumptool only captures; it does not crack. The companion hcxtools turns the pcapng into a hash file, and hashcat runs it against a wordlist. This is the modern replacement for the whole airodump-ng, aireplay-ng, aircrack-ng chain.

$ hcxpcapngtool -o hashes.22000 dump.pcapng

$ hashcat -m 22000 hashes.22000 /usr/share/wordlists/rockyou.txt

» Three usable items from one short capture, two of them client-free. Hand hashes.22000 to hashcat and you are testing whether those passphrases survive.

07Defending against it

The PMKID attack is powerful because it needs so little. The defences are the same ones that beat every wifi attack, which is reassuring: get these right and you are covered across the board.

» A long, random passphrase is the whole defence; PMKID or handshake, neither helps an attacker if the passphrase is never in a wordlist.

» Prefer WPA3, which changes the key exchange (SAE) so the offline PMKID attack does not apply.

» On WPA2, some access points let you disable the PMKID in the first message; do it where you can.

» Watch for capture activity with Kismet, though PMKID capture is quieter than a deauth flood.

» Re-run your own capture after any passphrase change to confirm it no longer cracks.

If your own network gives up a PMKID that then cracks, the fix is not to hide the PMKID, it is to make the passphrase uncrackable. Length and randomness beat every version of this attack.

↑ contents