Please add more detailed valid hash info #338
Comments
LLH-l
changed the title
|
partly done by this commit: Now you can use bash tools to e.g. sort handshakes by lowest timegap: In this way, 100% valid hashes can be filtered out through "M1M2M3" |
|
This important to know: BTW: A hc22000 hash file is a machine-readable file. It is not intended that people evaluate the data by hand. |
WPA022f6f8e8b95fcf1537de07424b61238a3786256a37308c8ddc9f59185e68891e79a84e5a4a7e88fa0e8909dda74e2ab310bf196035a7567f9d66838e404fc1b1d1c4d62172a4c7335c265ac0103007502010a00000000000000000000f094e260051da6561e9c789e32045bd3877ad34adeadab2100dc8c4bf7be4cac000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac02000002 04.11.2019 16:36:50 9232000 M32E2
Not right , add info like "M32E2" is redundana Because from the bitmask, can be inferred which messages it is composed So, best thing is me propose improvements above |
|
Ok, I remove this field. |
|
If no, it will encounter problems in the following situations etc.this situation For this situation, your may say, use --all, but use --all (not checking zeroed PMK, NC, etc.) Will convert more hashes |
|
No, because hashcat can do this better (due to its nonce-error-corrections) and much faster (due to using GPU). Example to remove hashes (PMKID and EAPOL): This kind of cleaning can be done on all hash files using all PMKs (e.g. from hashcat pot file). Get PMKs from hashcat 2200x potfile: You can always combine this 2 procedures: nonce-error-corrections=16 is only an example, depending on the quality for your dump file you can use much lower or much higher values. BTW: I suggest to read everything about hash mode 22001 on hash cat forum. |
|
Although it can handle some garbage hashes, and solve some problems |
|
Please add an example dump file. |
|
Important notice: From your example: Both are valid (time between MESSAGES is ok, REPLAYCOUNT is ok, MESSAGE NUMBER is in sequence). Please don't forget: |
Well, I agree your point of view, even if M1==M3 NONCE， If there are multiple M2 in the middle, and if the MIC is different, It Still unable to solve。 |
|
Halo, No |
|
I still don't understand the problem. An example from here: https://wiki.wireshark.org/SampleCaptures: Get general information about the dump file: We got some warnings, so it is a good idea to convert all hashes: Get some information about the hash file: We don't want to run a challenge message pair (possible false PSK) - so we take an authorized one (M2M3 E2): Get the word list: Run hashcat: I don't see a problem: |
|
I'm sure you notice the difference between a machine readable hc22000 file converted by hcxpcapngtool: and the human readable output of hcxhashtool: For me it doesn't make sense to add human readable information to a (by hashcat or JtR) machine readable hash file! |
|
Same source, but a different approach: This is the recommended way: These are only two examples how to use hcxhashtool. I suggest to code simple bash scripts tailored to your task that include all this this filter options. |
|
This is a very basic script that converts a dump file into different hc22000 files (authorized, PMKID): example: |
|
If M1 and M3 NONCE are not the same, m23E2 does not necessarily mean authorization, as has been proven in many cases ( Your should also know about it ) e.g Filter absolute valid hash Obtain human machine readability valid hash ！ |
|
I guess you're looking for a database tool that handles all your hashes. Such a data base tool is not part of hcxtools. Again the recommended workflow: And the most important point: Don't waste your time on ancient crappy dump files! If you have a dump file like this one, I recommend to put it in the trash can (where it belongs). If you convert it anyway (against all warnings) manual intervention is mandatory. The second important point: A hash file is not a data base file. If you got the PMK(!) you can remove it. The stats of wpa-sec (running hcxtools in background) is impressive: |
|
Regarding 22001 |
|
Hash mode 22001 is designed to verify an existing PMK or to clean a hash file. A typical application is: This will remove known hashes and hashes calculated from a zeroed PMK. Add every new/confirmed PMK to this list. |
When using hcxpcapngtool -- add - o
More detailed information needs to be added, which can be used to filter valid hashes more accurately and increase the recognition of absolutely valid hashes
E.G
time interval, accord with M1 to M3 authentication sequence conditions
In this way, 100% valid hashes can be filtered out through "M1M2M3"
This may take your some time to change !
The text was updated successfully, but these errors were encountered: