|
Crack WPA2 (.hc22000 file) with list not completing - Printable Version +- hashcat Forum (https://hashcat.net/forum) +-- Forum: Support (https://hashcat.net/forum/forum-3.html) +--- Forum: hashcat (https://hashcat.net/forum/forum-45.html) +--- Thread: Crack WPA2 (.hc22000 file) with list not completing (/thread-10496.html) Pages:
1
2
|
Crack WPA2 (.hc22000 file) with list not completing - Joe_Baker - 12-02-2021 I have a WPA2 hash file .hc22000 (so mode 22000) but when I try to find the password located in a small list of 5 words it just keeps running but doesn't complete it. I let the command run for an hour before closing it, it kept loading on "Initializing backend runtime for device #1. Please be patient...". I'm using the command: "hashcat -a 0 -m 22000 hashfile.hc22000 wordlist.txt". Does someone have experience with these .hc22000 files or maybe something wrong with my command? The hash looks like following: "WPA*02*<bunch of letters and numbers with a * from time to time>*02" Text file looks like following: " RandomWord anotherRandomWord password notMyPassword another " The command is running when I'm in the folder of hashcat (hashcat-6.2.5) and the files used are located in this folder as well. I get no error codes except "nvmlDeviceGetFanSpeed(): Not Supported" but this shouldn't be an issue from what I've read. I'm using a i7-9750h and RTX2060 so you would expect that it wouldn't take that long to get a hash from a 5 word long list (let alone a huge list like rockyou). P.S. I'm new to hashcat so it's possible I'm missing some obvious steps. RE: Crack WPA2 (.hc22000 file) with list not completing - v71221 - 12-08-2021 Try to play with -D option. At first, to show info about detected backend devices, run Code: hashcat.exe -IThen choose your device. In my case -D 1 means use CPU, works! -D 2 means use GPU, doesn't work, Device #2: Not enough allocatable device memory for this attack. For simplicity, you can enter the hash and password directly into the command line. Code: hashcat.exe -D 1 -a 3 -m 22000 "WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***" "hashcat!"It takes about 16 minutes in my case and it works. Status: Cracked This is an example hash you can find here: https://hashcat.net/wiki/doku.php?id=example_hashes or just Code: hashcat.exe -m 22000 --example-hashesBy the way, I'm also new to hashcat. I'm using Windows and a 10-year-old laptop with an Intel Celeron CPU and an Intel GPU. I was not able to use hashcat on Linux. Every time I got an "illegal hardware instruction" error. Now the fun part. pmkid-hash (format .hc22000) from real dump (captured by hcxdumptool) is not cracked. Status: Exhausted eapol-hash (format .hc22000) from the same real dump is cracked. Status: Cracked So far I have not been able to crack pmkid. I tried wordlist attack, brute-force attack, different dumpfiles, however result is the same. Status: Exhausted I can crack eapol-hash, but something wrong with pmkid-hash. May be the main reason is my weak hardware. Please answer what status you saw when you ran the commands below on your hardware. Cracked or Exhausted ? Code: hashcat.exe -D 1 -a 3 -m 22000 "WPA*01*f8dc238fb156874627b5ff251b8ab53c*020000000001*020000000020*61703031***" "12345678"Explanation of the hc22000 hash line you can find here https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 Please read this post as an example of troubleshooting of dictionary attack. https://hashcat.net/forum/thread-8602.html RE: Crack WPA2 (.hc22000 file) with list not completing - ZerBea - 12-08-2021 Now the fun part. pmkid-hash (format .hc22000) from real dump (captured by hcxdumptool) is not cracked. Status: Exhausted eapol-hash (format .hc22000) from the same real dump is cracked. Status: Cracked Indeed funny, but related to 802.11 attack mode and conversion mode: PMKID retrieved from ACCESS POINT. EAPOL MESSAGE PAIR retrieved from CLIENT M2. It the CLIENT is authorized, the PSK should be the same on both. If not, you'll get two different PSKs. The same will happen if the PSK is changed during capturing time. (BTW: both MACs look very synthetic - which let me assume that you're running a test environment) By default hcxdumptool/hcxlabtool attack both (AP and CLIENT) and hcxpcapngtool convert everything. All tools are analysis tools and it is mandatory that you know what you are doing (choosing the attack vector, converting the hash, selecting the desired hash to feed hashcat). Otherwise the result will be completely unexpected. RE: Crack WPA2 (.hc22000 file) with list not completing - v71221 - 12-08-2021 @ZerBea Thank you for your prompt reply. Yes, I am a newcomer, diligently studying hcxdumptool/hcxtools and using a test environment. Three notebooks with wifi-adapters, 1st with Linux and hcxdumptool/hcxtools, 2nd with Windows as wifi access point, and 3rd with Windows as client. For clarity and readability I changed MACs on AP and CLIENT. AP is created by these commands on Windows 7 Code: netsh wlan set hostednetwork mode=allow ssid=ap01 key=12345678 keyUsage=temporaryI ran this command to capture AP-CLIENT session. Code: $ sudo hcxdumptool -i wlan0 -o dump.pcapng --silent --enable_status=127 -c 1I used silent "passive" mode because client hung if I ran hcxdumptool in "active" mode. Could you kindly provide me with "proper" syntax of hcxdumptool options if I'm targeting PMKID only. By the way, I noticed that hcxhash2cap with option "--pmkid=" gives an error "reading hash line 1 failed". hcxhash2cap with option "--pmkid-eapol=" works fine. Input file in both cases is the same one-line-file pmkid.22000 Code: $ hcxhash2cap --pmkid=pmkid.22000 -c test.capRE: Crack WPA2 (.hc22000 file) with list not completing - ZerBea - 12-08-2021 --pmkid option is for old 16800 hash lines. It will give an ERROR on hc22000 files. By latest commit: https://github.com/ZerBea/hcxtools/commit/9e118e11672cd8c3933d2fb194372f342a6f71ad I added an additional information to --help: Shemale Black Videos Better NowAs of April 2026, the transgender community and LGBTQ culture are characterized by a profound tension between surging legislative challenges and a flourishing, resilient cultural movement focused on community-led care and innovation. 1. Legislative and Political Landscape The year 2026 has seen an intensification of legal battles, particularly in the United States, alongside significant global shifts in policy. Targeted Legislation: The ACLU is currently tracking over 500 anti-LGBTQ bills across U.S. state legislatures, focusing on bathroom access, gender-marker changes on IDs, and healthcare restrictions. High Court Rulings: The U.S. Supreme Court is expected to deliver landmark judgments by June 2026 on cases like West Virginia v. B.P.J. regarding transgender athletes and Chiles v. Salazar concerning conversion therapy bans. Global Duality: While countries like and Liechtenstein have recently embraced marriage equality, others such as and have implemented more restrictive laws regarding gender recognition and same-sex relations. 2. Health and Healthcare Trends Healthcare has emerged as a primary site of both conflict and "organized resilience". Refusal Laws: In the U.S., 11 states now have "conscientious objection" laws allowing providers to refuse treatment to LGBTQ patients based on personal beliefs. "Organize to OUTlast": This is the 2026 theme for National LGBTQ Health Awareness Week, urging communities to build independent support networks and affirming care systems in response to state-level divestment. Mental Health Disparities: Transgender individuals are nearly four times as likely as cisgender peers to experience mental health conditions, often linked to the stress of legislative hostility and discrimination. 3. Cultural Movements and Visibility Despite political pressure, LGBTQ culture is experiencing a "renaissance of intention". Science and Innovation: LGBT+ History Month 2026 adopted the theme of "Science and Innovation," celebrating queer contributions to STEM and using data-driven research to advocate for equity. Family Building: There is a record surge in LGBTQ family-building, with prospective parents increasingly demanding identity-aware adoption education and trans-inclusive fertility care. Workplace Inclusion: 72% of Fortune 500 companies now offer comprehensive health insurance for transgender employees, and 2026 has seen a rise in strategic Employee Resource Groups (ERGs) that influence corporate policy. 4. Community Challenges The "emotional fatigue" of constant visibility and policy shifts is a recurring theme in 2026. Safety and Visibility: 55% of transgender people have reported taking steps to be less visible in their local communities to avoid harassment. AI and Misinformation: The rise of AI-generated deepfakes and misinformation has become a new threat, often used to target activists and influence local school board policies. LGBTQ+ - NAMI 3. The Ballroom SceneOriginating in Harlem in the 1960s, ballroom culture was a sanctuary for trans women and gay men rejected by their families. The categories—from "Realness" to "Face"—were about survival: passing necessary to walk down the street safely. Today, ballroom vernacular ("shade," "reading," "slay") has saturated mainstream LGBTQ and internet culture, a direct pipeline from trans-led innovation to global pop vocabulary. Part IV: Distinct Challenges Within the LGBTQ UmbrellaWhile united under the rainbow flag, the transgender community faces unique hardships that are not always prioritized by LGB organizations. Community and Support
Part III: The Cultural Contributions of the Transgender CommunityIn the 21st century, the transgender community has moved from the margins to the center of LGBTQ cultural production. Part III: Cultural Contributions – Art, Drag, and the Ballroom SceneIf LGBTQ culture had a heart, it would beat to the rhythm of the ballroom scene. Made famous by the documentary Paris is Burning (1990) and the TV series Pose, ballroom was born out of the exclusion of Black and Latinx trans women and gay men from white-dominated gay bars in New York. Ballroom culture gave the world:
Furthermore, modern drag culture—exploded into the mainstream via RuPaul’s Drag Race—owes an immeasurable debt to trans women. While RuPaul himself has historically made controversial statements about trans contestants, many of the show’s most iconic queens (Monét X Change, Peppermint, and Sasha Colby, a trans woman who won Season 15) are actively reshaping the art form. Trans culture reminds us that drag is not mocking womanhood; it is celebrating the constructed nature of all gender. Conclusion: No Pride Without Trans PrideThe transgender community is not a separate cause from LGBTQ culture; it is the conscience of it. To celebrate Harvey Milk without honoring Marsha P. Johnson is to tell a half-truth. To fight for gay marriage while watching trans kids lose access to sports is to fracture the coalition. True LGBTQ culture recognizes that gender liberation underpins sexual liberation. As long as society punishes people for defying gender roles—whether a gay man wearing a dress or a trans woman simply existing—no one in the rainbow family is truly safe. The future of LGBTQ culture is trans-inclusive or it is nothing at all. By understanding history, amplifying trans voices, and fighting for healthcare, safety, and dignity for trans people, the LGBTQ community fulfills its original promise: that all of us, in all our beautiful complexity, deserve to love and live as our authentic selves. If you or someone you know is seeking resources, contact The Trevor Project (866-488-7386) or the Trans Lifeline (877-565-8860). For Black transgender individuals, the experience is profoundly different from their white counterparts due to the absence of white privilege and the presence of systemic racism. Marginalized Perspectives: Many, such as entertainer and activist TS Madison, describe navigating societal norms stacked against them due to their race, gender identity, and body size. Visibility as Activism: Content creation has become a powerful tool for self-affirmation and challenging heteronormative gender binaries. Community Dynamics: Support within the Black community can be complex, with some individuals facing preconceived notions or a lack of expected support. Digital Media and Representation Digital platforms like YouTube, Vine, and Instagram have provided space for Black trans voices to reach global audiences. Viral Success: Figures like TS Madison gained prominence through viral clips that showcased authenticity and bold personality. Educational Narratives: Video content often serves as a medium for "raw and real" discussions about transition, identity, and social activism. Defining Identity: Individuals often use video to clarify their own definitions of self—for example, identifying as a "transgender woman" rather than "transgender female". Key Considerations in Content Creation When producing or analyzing video content in this sphere, creators often focus on: Authenticity: Moving beyond "playing a role" to living an unapologetic life. Public Presentation: Understanding how visual perception and presentation can be "make or break" in a society that is still learning to understand diverse identities. As of April 2026, the transgender community and Self-Affirmation: Using digital spaces to affirm one's beauty and right to have a voice in a society often dominated by patriarchal norms. This report analyzes the online visibility, identity expression, and socioeconomic factors surrounding Black transgender women (often referred to by the slang term "shemale" in specific digital spaces) within the context of digital media and social platforms. Digital Presence and Identity Expression Black transgender creators utilize platforms like to build communities and express their identities. Analysis of social media trends reveals: Aesthetic Presentation : Creators often use high-impact visual content, including makeup, fashion, and fitness, to reclaim femininity and personal confidence. Community Building : Hashtags and video content serve as essential tools for marginalized groups to connect and resist external discrimination. Transgender Advocacy : Educational content, such as tutorials on "tucking" for swimwear, provides practical support for individuals in early transition. Socioeconomic and Health Realities The intersection of race and gender identity creates unique vulnerabilities and economic structures: HIV Prevention : Research from The New York Times highlights that Black and Latina transgender women face a disproportionately high risk of HIV infection due to poverty, stigma, and social isolation. Economic Participation : Barriers to traditional employment often lead many transgender women to the commercial sex industry, where being transgender may be viewed as an economic advantage rather than a barrier. Safety and Harassment The digital and physical safety of transgender individuals remains a critical concern: Sexual Violence : Transgender people are frequently targets of harassment, which includes the unsolicited sharing of sexual content and the use of transphobic slurs. Harassment Documentation : Research published in JAMA Network Open notes that online sexual violence often involves the non-consensual sharing of intimate images. AI responses may include mistakes. For legal advice, consult a professional. Learn more Title: More Than a Letter: Understanding the Transgender Community’s Vital Role in LGBTQ Culture If you look at the acronym LGBTQ+, the ‘T’ sits quietly in the middle. But that letter represents a community whose history, struggles, and triumphs are woven into the very fabric of queer culture. To understand the transgender community, you must understand its relationship to the broader LGBTQ+ movement—and conversely, to understand LGBTQ+ culture, you cannot ignore the revolutionary spirit of trans people. Let’s unpack that relationship, debunk some myths, and celebrate the beautiful, resilient culture that trans communities have built. The Historical Handshake: Why the ‘T’ Was Added Many outsiders assume that the "L," "G," and "B" are about sexual orientation (who you love) while the "T" is about gender identity (who you are). Because these seem different on paper, some have argued they don’t belong together. Historically, however, they have never been separate. In the 1960s and 70s, it was trans women—specifically trans women of color like Marsha P. Johnson and Sylvia Rivera—who were on the front lines of the Stonewall Riots, the uprising that birthed the modern LGBTQ+ rights movement. Back then, police raided gay bars, but they specifically targeted and arrested anyone whose gender presentation didn’t match their ID. Trans people weren't just allies; they were the shock troops. Part IV: Distinct Challenges Within the LGBTQ Umbrella LGBTQ+ culture exists because trans people refused to hide. The modern pride flag, the fight against police brutality, and the concept of "coming out" as a political act were all shaped by trans hands. Shared Struggles, Unique Battles LGBTQ+ culture is built on the foundation of fighting for the right to exist authentically. The transgender community shares common ground with LGB people in several key areas:
However, the trans community faces unique battles that the broader culture is only beginning to address. While a gay person might be accepted at work if they don't talk about their home life, a trans person cannot hide their identity if their legal documents don't match their appearance. This is why deadnaming (using a trans person’s former name) and bathroom bills are uniquely trans issues. The Vibrant Culture Within the Culture Transgender people haven't just participated in LGBTQ+ culture—they have defined its aesthetics and language.
Where Friction Exists (And How to Fix It) Honest conversation requires acknowledging that there has historically been friction. In the 1970s and 80s, some gay and lesbian groups tried to distance themselves from trans people, believing it would be easier to gain rights if they dropped the "T." This was a tactical error then and a moral failure in hindsight. Today, the movement is largely unified, but a subset of "LGB Alliance" and "TERFs" (Trans-Exclusionary Radical Feminists) try to drive a wedge between the groups. Their argument—that trans women are "men invading women's spaces"—is rejected by the overwhelming majority of the LGBTQ+ community. How to Be an Authentic Ally to Trans People If you are part of the broader LGBTQ+ community or just a straight/cis ally, here is how you honor the "T" in the acronym:
The Final Word: One Community, Many Experiences LGBTQ+ culture is not a monolith. It is a mosaic. The pink, lavender, and red stripes of the lesbian flag sit next to the blue, pink, and white of the trans flag for a reason. When the transgender community rises, the entire queer community rises with them. When trans kids are allowed to play soccer and read books without fear, every closeted gay kid in that town breathes easier. The 'T' is not a footnote. It is the spine of the book. Happy Pride. Protect Trans Joy. Have questions about how to support the trans people in your life? Drop them in the comments below. The Overlap ZoneWhile distinct, these categories bleed into one another organically. A trans woman who is attracted to men may identify as straight; a trans man attracted to men may identify as gay. Thus, transgender people also populate the "LGB" categories. This creates a unique dual-consciousness: transgender individuals often experience same-sex attraction from a different vantage point, enriching the diversity of LGBTQ culture. Furthermore, gender expression (masculinity, femininity, androgyny) is a trait shared by both cisgender LGB people and trans people. The gender-bending aesthetics of lesbian butch culture and gay bear culture directly parallel and influence trans masculine and trans feminine non-binary expressions. Beyond the Rainbow: Understanding the Transgender Community’s Vital Role in Shaping LGBTQ CultureFor decades, the public face of the LGBTQ+ rights movement was often simplified in media and politics to a single letter: "G." The narrative of Stonewall, the AIDS crisis, and the fight for marriage equality frequently centered on gay men and lesbians. But to understand the full tapestry of LGBTQ culture, one must look deeper—to the roots, the resilience, and the radicalism of the transgender community. The relationship between the transgender community and mainstream LGBTQ culture is not merely incidental; it is foundational. Without trans resistance, there would be no modern Pride. Without trans culture, queer art, language, and activism would be unrecognizable. This article explores the historical intersections, cultural contributions, and current tensions that define the trans experience within the broader queer spectrum. If you use --silent, hcxdumptool will become a simple dump tool like tshark, Wireshark, tcpdump. PMKIDs are not requested and a possible packet loss has to be expected. To request PMKIDs only: $ sudo hcxdumptool -i INTERFACE -o dump.pcapng --disable_client_attacks --disable_deauthentication --enable_status=95 For sure, some attack modes are extreme aggressive (as hell). They prevent that a CLIENT is able to connect to a NETWORK or they will let a CLIENT crash completely. BTW: I'm interested in a dump file from netsh hostednetwork. Can you please add a pcapng file from: netsh wlan set hostednetwork mode=allow ssid=ap01 key=12345678 keyUsage=temporary Usually the PMKID and the MIC should be calculated using the same PMK. It looks like this is not the case on netsh, which could be a bug inside of this tool. From what I read here: https://stackoverflow.com/questions/23168152/use-netsh-wlan-set-hostednetwork-to-create-a-wifi-hotspot-and-the-authenti only this types are supported by netsh: Radio types supported : 802.11n 802.11g 802.11b By default, PMKID caching is not activated. RE: Crack WPA2 (.hc22000 file) with list not completing - ZerBea - 12-08-2021 Great. The dump files are very appreciated. I'll take a look at them. Thanks. RE: Crack WPA2 (.hc22000 file) with list not completing - ZerBea - 12-08-2021 I have finished the analysis. The PMKID calculated by netsh is wrong! Looks like Windows has a problem with PMKIDs (not only on WPA2 Enterprise) since Windows 7: https://social.technet.microsoft.com/Forums/windows/en-US/c200b4c0-91af-42e9-863b-2b77451a5613/windows-7-not-sending-the-correct-pmkid Calculated PMKID by netsh (in WPA KEY DATA field packet 29 file 1, packet 27 file 2): f8dc238fb156874627b5ff251b8ab53c Calculated PMKID by function: ca5396d611cf330aebefd48ebbfb0e63 Code: PMKID = HMAC-SHA1-128(PMK, "PMK Name" | MAC_AP | MAC_STA)Corrected hash line to reproduce that hashcat will not fail: Code: WPA*01*ca5396d611cf330aebefd48ebbfb0e63*020000000001*020000000020*61703031***To answer your questions: 1. It doesn't matter if you capture PMKIDROGUE or PMKID. Both are suitable for PMKID-attacks. correct PMKIDROGUE = PMKID requested by hcxdumptool PMKID = PMKID captured after CLIENT request 2. In my case, pmkid-hash was not cracked (Status: Exhausted), probably due to a bug. correct, because netsh calculated a wrong PMKID!!! Now I have to find a way to detect this garbage. RE: Crack WPA2 (.hc22000 file) with list not completing - v71221 - 12-09-2021 @ZerBea I think we should start another thread called "PMKID Attack, Best Practices, Miscellaneous". In the meantime, could you advise something to the author of the current thread (Joe_Baker) based on your experience? For educational purposes, it is desirable to calculate PMK and PMKID manually. I found this link http://jorisvr.nl/wpapsk.html Could you please share your method. Perhaps you have written your own utility. Such a utility along with the source code would be a great help for newbies like me. RE: Crack WPA2 (.hc22000 file) with list not completing - ZerBea - 12-09-2021 "In the meantime, could you advise something to the author of the current thread (Joe_Baker) based on your experience?" To gain the necessary basic knowledge, hashcat FAQ are very helpful: https://hashcat.net/wiki/doku.php?id=fre...s#overview I couldn't explain it better than what is described in this general guide. BTW: It makes it very difficult to give an advice, because of missing information about the OS, version of NVIDA driver and version of CUDA SDK. There is no need to open a new thread, because nearly everything is already explained. Since Atom persuaded me to publish hcxtools (nearly the same time when hashcat went open source) I started a thread: https://hashcat.net/forum/thread-6661.html It describe how to use hcxtools and how to build a WiFi analysis environment. Another thread followed after we (again thanks to Atom and RealEnder) discovered the PMKID attack: https://hashcat.net/forum/thread-7717.html A WPA1/2 basic tutorial is here: https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 Inside this threads are several links to get more background information about the functions "behind the scenes". My advice is to read this basics and to play around with the examples mentioned above and here: https://hashcat.net/wiki/doku.php?id=example_hashes My second advice is to learn and understand Linux step by step: https://wiki.archlinux.org/title/Installation_guide BTW: A successful installation of K A L I by graphical installer is far away from learning and understanding Linux. That include openssl crypto: https://www.openssl.org/docs/man3.0/man7/crypto.html because it provide all functions to calculate and verify PMKs and PMKIDs. "Perhaps you have written your own utility." To find out how a PMK is calculated, please take a look at the source code of wlangenpmk (CPU based): https://github.com/ZerBea/hcxkeys Code: $ wlangenpmk -e ap01 -p 12345678or wlangenpmkocl (OpenCL based): Code: $ wlangenpmkocl -e ap01 -p 12345678There are similar functions (CPU based) in hcxpcapngtool, hcxhashtool and hcxpmkidtool as well as in hcxdumptool. RE: Crack WPA2 (.hc22000 file) with list not completing - v71221 - 12-11-2021 @ZerBea Great! Thanks! In the meantime, I discovered that the freshly installed Windows 11 Enterprise no longer sends PMKID (in contrast to Windows 7 Enterprise). At least by default. Please see the attachment. If you need dumps, please let me know. Could you please explain what "2412/1" means in the log of hcxdumptool (v6.2.5). For example, line like this Code: 22:09:57 2412/1 0015999e54c4 000bf4ad5332 TEST_AP [ROGUE PROBERESPONSE]What's the point of specifying [ROGUE PROBERESPONSE] in the log if hcxdumptool works with the --silent option From my newcomer point of view, it makes more sense to specify [PROBEREQUEST] instead. |