arsenal/hcxtools

hcxtools

capture conversion & triage · MIT

The companion to hcxdumptool. It turns raw captures into hashcat-ready hashes, filters them down to what matters, and tells you what a capture actually contains.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01The bridge between capture and cracking

A pcapng full of frames is not something hashcat can read. hcxtools sits in the middle: it reads the capture, pulls out the PMKIDs and handshakes, and writes them in the exact format the cracker expects. It also helps you triage, so you are not wasting GPU time on duplicates or on networks that are out of scope.

» hcxpcapngtool: convert a capture to the hashcat 22000 format.

» hcxhashtool: filter and deduplicate a hash file by ESSID, BSSID, or type.

» hcxpsktool: generate candidate passwords from capture metadata.

» Several smaller helpers for inspecting and cleaning captures.

02Install

$ sudo emerge net-wireless/hcxtools # Gentoo

$ sudo apt install hcxtools # Debian / Ubuntu / Kali

$ sudo dnf install hcxtools # Fedora

» Like hcxdumptool, hcxtools moves fast and option names can shift between versions. If a flag is rejected, check --help; the workflow below is stable.

↑ contents

03Convert a capture to a crackable hash

This is the one command you will run most. hcxpcapngtool reads the pcapng from hcxdumptool and writes a 22000 file. The summary it prints is a useful sanity check: it tells you how many PMKIDs and handshakes were actually usable, which is often fewer than the FOUND lines during capture suggested.

$ hcxpcapngtool -o hashes.22000 dump.pcapng

» Fourteen usable items here, written to hashes.22000. best means the strongest, least ambiguous captures; those are the ones worth cracking first.

04Filter down to your own networks

A wardriving capture holds many networks. For an authorised test you crack only the ones you are allowed to, so filter the hash file by ESSID or BSSID before it ever reaches hashcat. hcxhashtool does this cleanly and also removes duplicates so you are not cracking the same network twice.

$ hcxhashtool -i hashes.22000 --essid=HomeLab -o homelab.22000

$ hcxhashtool -i hashes.22000 --info=stdout | head

» Now homelab.22000 contains only the network you own. This is both faster and the correct scope for a lawful assessment.

05Hand off to hashcat

With a clean, scoped hash file, the final step belongs to hashcat on a GPU. Mode 22000 covers both PMKID and handshake in one file.

$ hashcat -m 22000 homelab.22000 /usr/share/wordlists/rockyou.txt

» See the hashcat guide for wordlists, rules, and masks. For the capture side, hcxdumptool is where these files come from, and the aircrack-ng guide covers the older client-plus-deauth path.

↑ contents

06What the summary tells a defender

Run hcxpcapngtool against a capture of your own airspace and read the summary as a report card.

» A PMKID count above zero for your network means your AP offers PMKID; prefer WPA3 or disable it if your AP allows.

» An EAPOL pair means a full handshake was catchable; a long random passphrase makes that harmless.

» The ESSID list shows every network you broadcast, including any forgotten test or guest SSIDs worth shutting down.

» If filtered-to-yours hashes then crack in hashcat, that is the one finding that matters: change the passphrase.

The tools make cracking easy, which is the whole argument for a passphrase that no wordlist will ever hold. Convert, filter to your own, try to crack, and keep raising the bar until you cannot.

↑ contents