hcxdumptool
hcxdumptool Description
A small tool for capturing packets from wireless network devices and detecting weaknesses in Wi-Fi networks (for example, PreSharedKey or PlainMasterKey are transmitted unencrypted by the CLIENT).
The pcapng capture format is compatible with Wireshark and tshark.
hcxdumptool is for analysis. This means everything is requested/saved by default. Unwanted information must be filtered later, offline.
Program features:
- complete blocking of wlan traffic
- can capture PMKIDs from access points (requires only one PMKID from access point) (use hcxpcapngtool to convert them to a format understandable by hashcat and/or JtR)
- can capture handshakes from unconnected clients (requires only one single M2 from the client) (use hcxpcapngtool to convert them to a format understandable by hashcat and/or JtR)
- can capture handshakes from 5/6 GHz clients on 2.4 GHz (requires only one single M2 from client) (use hcxpcapngtool to format to hashcat or JtR hash)
- can capture passwords from wlan traffic (use hcxpcapngtool -E to save them to file along with network names)
- can query and capture extended EAPOL (RADIUS, GSM-SIM, WPS) (hcxpcapngtool will show you info about them)
- can collect IDs from wireless network traffic (for example: request IMSI numbers from mobile phones – use hcxpcapngtool -I to save them to a file)
- can capture usernames from wlan traffic (eg: server authentication username – use hcxpcapngtool -U to save them to a file)
This package includes 2 utilities:
- hcxdumptool (the main utility for analyzing the Wi-Fi range and performing wireless attacks)
- hcxnmealog (an auxiliary utility for working with GPS)
Homepage: https://github.com/ZerBea/hcxdumptool
Author: ZeroBeat
License: MIT
hcxdumptool Help
Usage:
hcxdumptool OPTIONS
Options:
most common options:
--------------------
-i INTERFACE : name of INTERFACE to be used
default: first suitable INTERFACE
warning:
hcxdumptool changes the mode of the INTERFACE
hcxdumptool changes the virtual MAC address of the INTERFACE
hcxdumptool changes the channel of the INTERFACE
-w OUTFILE : write packets to a pcapng-format file named OUTFILE
default OUTFILE name: yyyyddmmhhmmss-interfacename.pcapng
existing file will not be overwritten
get more information: https://pcapng.com/
-c DIGIT : set channel (1a,2a,36b,...)
default: 1a,6a,11a
important notice: channel numbers are not unique
it is mandatory to add band information to the channel number (e.g. 12a)
band a: NL80211_BAND_2GHZ
band b: NL80211_BAND_5GHZ
band c: NL80211_BAND_6GHZ
band d: NL80211_BAND_60GHZ
band e: NL80211_BAND_S1GHZ (902 MHz)
to disable frequency management, set this option to a single frequency/channel
-f DIGIT : set frequency (2412,2417,5180,...)
-F : use all available frequencies from INTERFACE
-t SECOND : minimum stay time (will increase on new stations and/or authentications)
default 5 seconds
-A : ACK incoming frames
INTERFACE must support active monitor mode
-L : show PHYSICAL INTERFACE list and terminate
-l : show PHYSICAL INTERFACE list (tabulator separated and greppable) and terminate
-I INTERFACE : show detailed information about INTERFACE and terminate
--bpfc=FILTER : compile Berkeley Packet Filter (BPF) and exit
$ hcxdumptool --bpfc="wlan addr3 112233445566" > filter.bpf
see man pcap-filter
--bpfd=MODE : set output mode for compiled Berkeley Packet Filter (BPF)
default = 0
0 = compile BPF code as decimal numbers (readable by --bpf)
1 = compile BPF code as decimal numbers preceded with a count (readable by --bpf)
2 = compile BPF code as a C program fragment (readable by --bpf)
3 = compile BPF code as a ASM program (tcpdump style)
4 = compile BPF code as as decimal numbers (bpf_debug style)
see man pcap-filter
--bpf=FILE : input Berkeley Packet Filter (BPF) code (maximum 4096 instructions) in tcpdump decimal numbers format
see --help for more information
--ftc : enable fake time clock
--rds=DIGIT : enable real time display
attack mode:
0 = off(default)
1 = show APs on current channel, show CLIENTs (M1M2ROGUE)
2 = show all APs (M1M2, M1M2M3 or PMKID), show CLIENTs (M1M2ROGUE)
3 = show all APs, show CLIENTs (M1M2ROGUE)
columns:
E = encryption (e)ncrypted / (o)pen
A = AKM (p)re-shared key
1 = received M1
2 = received M1M2
3 = received M1M2M3
P = received PMKID
rcascan mode
0 = show APs on current channel sorted by BEACON timestamp
1 = show APs on current channel sorted by PROBERESPONSE timestamp
2 = show APs on current channel sorted by RSSI
3 = show APs of all channels sorted by RSSI
--rdt : disable TIOCGWINSZ for real time displays
--rcascan=DIGIT : radio channel assement scan
(a)ctive = active scan (transmit undirected PROBEREQUEST frames)
no PROBERESPONSE, AP is out of RANGE, packet injection is broken
(p)assive = passive scan (listen only)
-h : show this help
-v : show version
less common options:
--------------------
-m INTERFACE : set monitor mode and terminate
--m2max=DIGIT : set maximum of received M1M2ROGUE
default: 4 M1M2ROGUE
to reject CLIENTs set 0
--associationmax=DIGIT : set maximum of attempts to associate with an AP
default: 100 attempts
to disable association with an AP set 0
--disable_disassociation : do not transmit DISASSOCIATION frames
--proberesponsetx=DIGIT : transmit n PROBERESPONSEs from the ESSID ring buffer
default: 1023
--essidlist=FILE : initialize ESSID list with these ESSIDs
--errormax=DIGIT : set maximum allowed ERRORs
default: 100 ERRORs
--watchdogmax=SECONDS : set maximum TIMEOUT when no packets received
default: 600 seconds
--tot=DIGIT : enable timeout timer in minutes
--exitoneapol=TYPE : exit on first EAPOL occurrence:
bitmask:
1 = PMKID (from AP)
2 = EAPOL M1M2M3 (authorized)
4 = EAPOL M1M2 (not authorized)
8 = EAPOL M1M2ROGUE (not authorized)
16 = EAPOL M1
target BPF filter is recommended
--onsigterm=ACTION : action when the program has been terminated (poweroff, reboot)
poweroff: power off system
reboot: reboot system
--ongpiobutton=ACTION : action when the program has been terminated (poweroff, reboot)
poweroff: power off system
reboot: reboot system
--ontot=ACTION : action when the program has been terminated (poweroff, reboot)
poweroff: power off system
reboot: reboot system
--onwatchdog=ACTION : action when the program has been terminated (poweroff, reboot)
poweroff: power off system
reboot: reboot system
--onerror=ACTION : action when the program has been terminated (poweroff, reboot)
poweroff: power off system
reboot: reboot system
--gpio_button=DIGIT : Raspberry Pi GPIO pin number of button (2...27)
push GPIO button (> 10 seconds) to terminate program
default: 0 (GPIO not in use)
--gpio_statusled=DIGIT : Raspberry Pi GPIO number of status LED (2...27)
default: 0 (GPIO not in use)
--help : show additional help (example and trouble shooting)
--version : show version
hcxnmealog Help
Usage:
hcxnmealog OPTIONS
Options:
-n FILE : output nmea 0183 track to file
track append to file: filename
use gpsbabel to convert to other formats:
gpsbabel -w -t -i nmea -f in_file.nmea -o gpx -F out_file.gpx
gpsbabel -w -t -i nmea -f in_file.nmea -o kml -F out_file.kml
time = UTC (in accordance with the NMEA 0183 standard)
-t FILE : output separated by tabulator (tsv)
columns:
LINUX EPOCH (seconds that have passed since the date January 1st, 1970)
use date -d @epoch_value to convert to human readable time
BSSID (MAC ACCESS POINT)
ESSID (network name)
COUNTRY CODE (ISO / IEC 3166 alpha2 country code)
ENCRYPTION (encrypted / open)
RSN INFORMATION ELEMENT (WPA2/WPA3)
bitmask (--help for more information)
WPA INFORMATION ELEMENT (WPA1)
bitmask (--help for more information)
FREQUENCY (interface frequency in MHz)
CHANNEL
RSSI (signal strength in dBm)
lATITUDE (decimal degrees)
LONGITUDE (decimal degrees)
ALTITUDE (decimal degrees)
SPEED (knots)
PDOP (position -3D- dilution of precision)
HDOP (horizontal dilution of precision)
VDOP (vertical dilution of precision)
-d DEVICE : GPS source
use gpsd: gpsd
use device: /dev/ttyACM0, /dev/tty/USBx, ...
get more information: https://en.wikipedia.org/wiki/NMEA_0183
depending on the device it can take a while to get a fix
-b DIGIT : baud rate of GPS device
default: 9600
-i INTERFACE : name of INTERFACE to be used
-h : show this help
-v : show version
--bpf=FILE : input Berkeley Packet Filter (BPF) code (maximum 4096 instructions) in tcpdump decimal numbers format
see --help for more information
--help : show additional help
--version : show version
Recommended usage guidelines
Do not use a logical interface and leave the physical interface in managed mode.
Do not use hcxdumptool in combination with aircrack-ng, reaver, bully or other tools which takes access to the interface.
Stop all services which takes access to the physical interface (NetworkManager, wpa_supplicant,...).
Do not use tools like macchanger, as they are useless, because hcxdumptool uses its own random mac address space.
Work flow
The sequence of using the tools is as follows: hcxdumptool → hcxpcapngtool → hcxhashtool (additional hcxpsktool/hcxeiutool) → hashcat or JtR
- hcxdumptool: attack and capture everything (depending on options)
- hcxpcapngtool: convert everything
- hcxhashtool: filter hashes
- hcxpsktool: get weak PSK candidates
- hcxeiutool: calculate wordlists from ESSID
- hashcat or JtR: get PSK from hash
Recommendations
- Make sure that the Wireless Regulatory Domain is not unset!
- Run
sudo hcxdumptool -i interface --do_rcascan
for at least 30 seconds, to get information about the target!
- Do not edit, merge or convert this pcapng files, because it will remove optional comment fields!
- It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this, as well as wpa-sec.stanev.org.
- If hcxdumptool captured your password from WiFi traffic, you should check all your devices immediately!
- If you use GPS, make sure GPS device is inserted and has a GPS FIX, before you start hcxdumptool!
- Recommended tools to show additional 802.11 fields or to decrypt WiFi traffic: Wireshark and/or tshark
- Recommended tool to convert hashes to formats that hashcat and JtR understand: hcxpcapngtool
- Recommended tool to get possible PSKs from pcapng file: hcxpcapngtool
- Important notice: Using filter options, could cause that some useful frames are filtered out! In that case hcxpcapngtool will show a warning that this frames are missing!
- Use SIGHUB with care, because it will impact pselect()
Abbreviations
- PMKIDROGUE = PMKID requested from ACCESS POINT by hcxdumptool
- M1M2ROGUE = M2 requested from CLIENT by hcxdumptool
- M1M2 = CHALLENGE MESSAGE PAIR
- M2M3 = AUTHORIZED MESSAGE PAIR
- M3M4 = AUTHORIZED MESSAGE PAIR
- M1M4ZEROED = M4 SNONCE is zeroed and cannot be used to calculate MESSAGE PAIR
- M3M4ZEROED = M4 SNONCE is zeroed and cannot be used to calculate MESSAGE PAIR
- KDV0 = Key Descriptor Version 0 = Authentication Management Key defined
- KDV1 = Key Descriptor Version 1 = WPA1 HMAC-MD5
- KDV2 = Key Descriptor Version 2 = WPA2 HMAC-SHA1
- KDV3 = Key Descriptor Version 3 = WPA2 AES-128-CMAC
hcxdumptool Usage Example
Use the wireless interface (-i wlp39s0f3u4u5), it will be automatically switched to monitor mode, save the captured frames to a pcapng file (-o output.pcapng), stay on each channel for 5 seconds (-t 5), show EAPOL messages and PROBEREQUEST/PROBERESPONSE (--enable_status=3):
sudo hcxdumptool -i wlp39s0f3u4u5 -o output.pcapng -t 5 --enable_status=3
Example output:
start capturing (stop with ctrl+c) NMEA 0183 SENTENCE........: N/A INTERFACE NAME............: wlp0s20f0u2 INTERFACE PROTOCOL........: IEEE 802.11 INTERFACE TX POWER........: 36 dBm (lowest value reported by the device) INTERFACE HARDWARE MAC....: 00c0ca96cfcb (not used for the attack) INTERFACE VIRTUAL MAC.....: 00c0ca96cfcb (not used for the attack) DRIVER....................: ath9k_htc DRIVER VERSION............: 5.16.8-arch1-1 DRIVER FIRMWARE VERSION...: 1.4 openSSL version...........: 1.1 ERRORMAX..................: 100 errors BPF code blocks...........: 0 FILTERLIST ACCESS POINT...: 0 entries FILTERLIST CLIENT.........: 0 entries FILTERMODE................: unused WEAK CANDIDATE............: 12345678 ESSID list................: 0 entries ACCESS POINT (ROGUE)......: 000e1726743a (BROADCAST HIDDEN used for the attack) ACCESS POINT (ROGUE)......: 000e1726743b (BROADCAST OPEN used for the attack) ACCESS POINT (ROGUE)......: 000e1726743c (used for the attack and incremented on every new client) CLIENT (ROGUE)............: b025aac62e0f EAPOLTIMEOUT..............: 20000 usec EAPOLEAPTIMEOUT...........: 2500000 usec REPLAYCOUNT...............: 62969 ANONCE....................: 5630c66168cdb3f4a93da3509541b808afd72bf2e848576f822b8ddd3e6a1006 SNONCE....................: 3f4872fcafb3165345aa603842c7f01039763994419cbd80ada5fa239f7673bf 10:28:24 2412/1 ffffffffffff c891f9c7eff6 RT-728005 [BEACON] 10:28:24 2412/1 ffffffffffff 142e5e5636f0 RT-WiFi-36EE [BEACON] 10:28:24 2412/1 ffffffffffff e4186b1abe4c 114 [BEACON] 10:28:24 2412/1 ffffffffffff e8377a94a520 Keenetic-1606 [BEACON] 10:28:25 2412/1 7aa0dc189b9b c891f9c7eff6 RT-728005 [PROBERESPONSE] 10:28:25 2412/1 7aa0dc189b9b e4186b1abe4c 114 [PROBERESPONSE] 10:28:25 2412/1 ffffffffffff 6466b3489a20 TP-LINK_489A20 [BEACON] 10:28:26 2412/1 ffffffffffff f0b4d29f8889 DIR-615-8888 [BEACON] 10:28:26 2412/1 ffffffffffff bc0f9a24a294 DIR-615-A293 [BEACON] 10:28:28 2412/1 ffffffffffff 78321b502db0 DIR-615 [BEACON] 10:28:28 2412/1 b025aac62e0f c891f9c7eff6 RT-728005 [PMKIDROGUE:7a611b478d7ad30d13f884033de72a6d KDV:2] 10:28:33 2412/1 daa119a3ce9b 6466b3489a20 TP-LINK_489A20 [PROBERESPONSE] 10:28:36 2412/1 d8a98ba2e8f8 f0b4d29f8889 DIR-615-8888 [PROBERESPONSE] 10:28:39 2412/1 304a261d7203 bc0f9a24a294 DIR-615-A293 [PROBERESPONSE] 10:28:48 2412/1 52983911000d e8377a94a520 Keenetic-1606 [PROBERESPONSE] 10:28:52 2412/1 ffffffffffff 24d3f2aa99a5 RT-WiFi_66 [BEACON] 10:29:25 2412/1 4c6371e0e52e 142e5e5636f0 RT-WiFi-36EE [PROBERESPONSE] 10:29:42 2412/1 d8c0a6b19e25 78321b503d48 DIR-615-3D47 [PROBERESPONSE] 10:30:00 2417/2 ffffffffffff d8af817653ce RT-WiFi-53CD [BEACON] 10:30:00 2417/2 ffffffffffff ec43f6dc7d68 Jenechka [BEACON] 10:30:00 2417/2 ffffffffffff 045ea4543b86 [HIDDEN BEACON] 10:30:02 2417/2 402f86f57436 ec43f6dc7d68 Jenechka [PROBERESPONSE] 10:30:08 2417/2 304a261d7203 d8af817653ce RT-WiFi-53CD [PROBERESPONSE] 10:30:11 2417/2 ffffffffffff c471544fbb30 TP-LINK_BB30 [BEACON] 10:30:26 2417/2 9444443388b6 000e1726743e Moto G (5S) Plus 110282 [AUTHENTICATION] 10:30:26 2417/2 9444443388b6 000e1726743e Moto G (5S) Plus 110282 [ASSOCIATION] 10:30:44 2417/2 9444443388b6 000e1726743e Moto G (5S) Plus 110282 [REASSOCIATION] 10:30:57 2417/2 ffffffffffff f8f082b2d0df trytek_76 [BEACON] 10:31:47 2417/2 008e7af12a6e 000e1726743f RT-104 [AUTHENTICATION] 10:31:47 2417/2 008e7af12a6e 000e1726743f RT-104 [ASSOCIATION] 10:31:47 2417/2 008e7af12a6e 000e1726743f RT-104 [EAPOL:M1M2ROGUE EAPOLTIME:169 RC:62969 KDV:2] 10:31:57 2417/2 586356f41838 c471544fbb30 TP-LINK_BB30 [PROBERESPONSE] 10:32:00 2422/3 ffffffffffff f81a67494462 Old'est_WEB [BEACON] 10:32:05 2422/3 daa119f66eb6 e865d48431c1 Tenda_8431C0 [PROBERESPONSE]
Modified Raspberry Pi, aggressive mode with deauthentication (default), mobile (fast switching between channels, this is the default), targets APs (default) and CLIENTS (--active_beacon):
sudo hcxdumptool --gpio_button=4 --gpio_statusled=17 -i wlan0 -o dump.pcapng --poweroff --stop_ap_attacks=6000 --resume_ap_attacks=12000 --bpfc=own.bpfc --essidlist=beaconlist --active_beacon
Modified Raspberry Pi, stationary (long switching between channels “-t 120”), targets CLIENTS (--disable_deauthentication --disable_ap_attacks --active_beacon):
sudo hcxdumptool --gpio_button=4 --gpio_statusled=17 -i wlan0 -o dump.pcapng --tot=1440 --bpfc=own.bpfc --disable_deauthentication --disable_ap_attacks --active_beacon -c 1,3,5,7,9,11,2,4,6,8,10 -t 120
Client-only EAP probing attack using tunneled PEAP sequence MS-CHAP-V2, EAP-MD5, GTC:
sudo hcxdumptool -i wlan0 -t 120 -o dump.pcapng --enable_status=1567 --disable_deauthentication --disable_ap_attacks --wpaent --eaptlstun --eap_server_cert=server.crt --eap_server_key=server.key --eapreq=1921:-,T:1a0104001610000102030405060708090a0b0c0d0e0f20:-,T:04010020:-,T:06:-
How to install hcxdumptool
Installation on Kali Linux
sudo apt install hcxdumptool
Installation on BlackArch
sudo pacman -S hcxdumptool
Installation on Debian, Linux Mint, Ubuntu and their derivatives
sudo apt install libssl1.1 libssl-dev git git clone https://github.com/ZerBea/hcxdumptool cd hcxdumptool/ make sudo make install
hcxdumptool Screenshots
hcxdumptool Tutorials
- Hacking Wi-Fi without users
- USB Wi-Fi Adapters with monitor mode and wireless injection (100% compatible with Kali Linux)
- Wi-Fi security audit improved: new tools, hash, and techniques
- Wi-Fi security audit with Hashcat and hcxdumptool
Related tools
- Airmon-ng (93.4%)
- WiFite (59%)
- Aircrack-ng (Tool) (59%)
- Router Scan (59%)
- Fern Wifi Cracker (59%)
- WiFi-Pumpkin (ex 3vilTwinAttacker) (RANDOM - 52.8%)
Comments are Closed