hcxdumptool

By

Brian Johnson

This tool is awesome for wifi shenanigans.

Install

git clone https://github.com/ZerBea/hcxdumptool.git ~/hcxdumptool
cd ~/hcxdumptool
sudo apt install build-essential git libpcap-dev -y
make -j $(noproc)

Enumerate nearby wifi

sudo hcxdumptool -i wlan0mon -F --rcascan=active

Attack just specific channels

sudo hcxdumptool -i wlan0mon -F --rds=1 -c40b,44b -w dump.pcapng

Basic run to start enumerating/attacking all the wifis

Taking these tips from this issue. This Cyberark blog was also very helpful.

sudo hcxdumptool -i INTERFACENAME -w dumpfile.pcapng --rds=1 -F

Build a filter list

Check out this issue for a good example. Also check out this discussion.

Capture away!

Capture with BPF

hcxdumptool -i NAME-OF-PHYSICAL-WIFI-INTERFACE --bpf=attack.bpf -w output.pcapng --rds=1 -F

Capture with BPF and specific channels

hcxdumptool -i NAME-OF-PHYSICAL-WIFI-INTERFACE --bpf=attack.bpf -w output.pcapng --rds=1 -F -c 55,23

As the scan runs you'll see a table with heading:

R 1 3 P S

• R - AP in range or under attack
• 1 - got EAPOL M1 challenge
• 3 - got EAPOL M1M2M3 or EAPOL (hashcat/JTR can work with this)
• P - got PMKID (hashcat/JTR can work with this)
• S - authentication key management PSK

real time display:
 R = + AP display:     AP is in TX range or under attack
 S = + AP display:     AUTHENTICATION KEY MANAGEMENT PSK
 P = + AP display:     got PMKID
 1 = + AP display:     got EAPOL M1 (CHALLENGE)
 3 = + AP display:     got EAPOL M1M2M3 (AUTHORIZATION)
 E = + CLIENT display: got EAP-START MESSAGE
 2 = + CLIENT display: got EAPOL M1M2 (ROGUE CHALLENGE)