Documentation
¶
Overview ¶
Package eapolcap extracts WPA/WPA2 4-way-handshake (EAPOL type-02) hashes from an 802.11 packet capture and emits ready-to-crack hashcat mode-22000 lines.
The 4-way handshake is the classic WPA2 capture: when a client associates, the AP and station exchange four EAPOL-Key frames. Message 1 (AP -> STA) carries the ANonce; message 2 (STA -> AP) carries the SNonce and the MIC computed over the EAPOL frame with the PTK. With the ANonce (from M1), the MIC and the MIC-bearing EAPOL frame (from M2), and both MACs and the ESSID, a crackable hash is recovered. The canonical pcap -> .hc22000 converter is hcxpcapngtool (a third-party C binary); this does the dominant M1+M2 case natively, composing the in-tree decoders: the pcap / pcapng readers (internal/pcap, internal/pcapng), the DS-bit-correct 802.11 frame parser (internal/ieee80211), the EAPOL-Key dissector (internal/eapol), and the mode-22000 line builder (internal/hashcat, anchored on hashcat's published example). It is the type-02 counterpart of internal/pmkidcap (type-01, clientless PMKID); the capture-walk deliberately mirrors that package rather than coupling the two extractors.
No confidently-wrong output: only 802.11 / radiotap link types are decoded (link type 105 / 127); a handshake is emitted only when a real M1 (Ack, no MIC) is paired with a real M2 (MIC set) sharing the same BSSID, station MAC and 8-byte replay counter — the structural guarantee they belong to the same exchange; the MIC field is zeroed in the emitted EAPOL frame (as hashcat requires); the all-zero MIC an incomplete M2 would carry is dropped; and the crackable line is built only once the ESSID has been seen in a beacon / probe-response / association-request (a handshake with no ESSID is reported, with a note, but no line is fabricated).
Two message pairs are extracted: M1+M2 (ANonce from M1, hashcat message_pair 0x00) and — when M1 was missed — M2+M3 (ANonce from the M3 whose replay counter is the M2's + 1, message_pair 0x02; the M2 still supplies the MIC and the MIC-bearing frame). The 0x02 index is anchored on hashcat's own published mode-22000 example, which is itself an M2+M3 case. Clean-capture lines carry no nonce-correction flags (0x10/0x20/0x80); the M1+M4 and M3+M4 pairings and nonce-error-correction heuristics remain deferred.
Wrap-vs-native: native — orchestration over in-tree decoders plus a fixed LLC/SNAP + EtherType check and the documented EAPOL-Key frame layout; stdlib only, no new go.mod dependency.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Handshake ¶
type Handshake struct {
BSSID string `json:"bssid"`
StationMAC string `json:"station_mac"`
ESSID string `json:"essid,omitempty"`
ANonce string `json:"anonce"` // from M1
MIC string `json:"mic"` // from M2
ReplayCounter string `json:"replay_counter"` // shared by M1 and M2
MessagePair string `json:"message_pair"` // "00" (M1+M2)
// HC22000Line is the ready-to-crack hashcat mode-22000 line, built only when
// the ESSID is known.
HC22000Line string `json:"hc22000_line,omitempty"`
Note string `json:"note,omitempty"`
// contains filtered or unexported fields
}
Handshake is one recovered WPA/WPA2 4-way handshake (M1 + M2).
type Result ¶
type Result struct {
Format string `json:"format"`
LinkType string `json:"link_type"`
Packets int `json:"packets"`
NetworksSeen int `json:"networks_seen"`
Handshakes []Handshake `json:"handshakes"`
HashcatCmd string `json:"hashcat_command,omitempty"`
Note string `json:"note"`
}
Result is the outcome of a capture scan.
Source Files