Documentation
¶
Overview ¶
Package hashcat builds hashcat-crackable hash lines natively, in pure Go.
Wrap-vs-native judgement ¶
Native. The canonical pcap → .hc22000 converter in the ecosystem is hcxpcapngtool (hcxtools), a separate C binary the marauder_handoff_hashcat tool shells out to. The hashcat mode-22000 LINE FORMAT, however, is a short, fully-documented, deterministic text layout — a "*"-delimited record — that needs no external binary to assemble once the operator holds the fields. Reimplementing the PMKID-line format natively removes a third-party dependency for the clientless-PMKID case (the dominant modern WPA2 capture): given the PMKID and the two MACs + ESSID an operator already has (from wifi_eapol_decode, a Marauder sniffpmkid run, or a Proxmark-style capture), it emits the ready-to-crack line offline.
Correctness is anchored on hashcat's own published example hash for mode 22000 (the ESSID field decodes to the ASCII "hashcat-essid", a strong self-consistency check that the example is reproduced exactly).
Covered ¶
- PMKID lines (message type 01): WPA*01*PMKID*AP_MAC*STA_MAC*ESSID***.
- EAPOL 4-way-handshake lines (message type 02): WPA*02*MIC*AP_MAC*STA_MAC*ESSID*ANONCE*EAPOL*MESSAGEPAIR. Built from the fields an operator already holds once a handshake is decoded (MIC, AP nonce, the EAPOL frame bytes, the message-pair byte). Anchored on hashcat's published mode-22000 EAPOL example (the ESSID decodes to ASCII "TP-LINK_HASHCAT_TEST").
Deliberately deferred ¶
- pcapng PARSING — extracting those type-02 fields from a raw capture (pairing M1/M2/M3/M4, computing the message-pair flags) is the larger native-pcapng effort hcxpcapngtool still does. This package assembles the line once the fields are in hand; it does not parse the capture.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EAPOL ¶ added in v0.687.0
func EAPOL(mic, apMAC, staMAC string, essid []byte, anonce, eapol, messagePair string) (string, error)
EAPOL builds a hashcat mode-22000 EAPOL 4-way-handshake (type 02) line from the fields of a decoded handshake. The output is the single line
WPA*02*<mic>*<ap_mac>*<sta_mac>*<essid_hex>*<anonce>*<eapol>*<message_pair>
All hex is lower-cased. The caller adds a trailing newline when writing a .hc22000 file.
mic must be 16 bytes; apMAC and staMAC 6 bytes each; anonce 32 bytes; messagePair 1 byte (separators and a 0x prefix are tolerated on every hex field); essid 1..32 bytes; eapol 1..256 bytes (hashcat's EAPOL field cap). A confidently-malformed field is rejected rather than emitted, so the line never silently fails to crack.
func PMKID ¶
PMKID builds a hashcat mode-22000 PMKID (type 01) line from the four fields of a clientless-PMKID capture. The output is the single line
WPA*01*<pmkid>*<ap_mac>*<sta_mac>*<essid_hex>***
with the three trailing fields (ANONCE, EAPOL, MESSAGEPAIR) empty, as hashcat requires for a PMKID record. All hex is lower-cased. The caller adds a trailing newline when writing a .hc22000 file.
pmkid must be 16 bytes (32 hex chars); apMAC and staMAC must be 6 bytes each (separators and a 0x prefix are tolerated); essid must be 1..32 bytes (the 802.11 SSID length limit). A confidently-malformed field is rejected rather than emitted, so the line never silently fails to crack.
Types ¶
This section is empty.
Source Files