hcxtools

No entries match these filters. Clear filters

1. docs update Oct 10, 2026 · issue 101

   hcxtools adds hcxeiutool, a new CLI for splitting wordlists into digit, hex-digit, alpha, and case-sensitive sub-lists via -i/-d/-x/-c/-s flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Split a large wordlist into focused sub-lists — digit-only, hex-digit, alpha, and case-sensitive — to feed specialised hashcat rule sets for WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. cracking.
   copy

   $ hcxeiutool -i rockyou.txt -d digits.txt -x hexdigits.txt -c alpha.txt -s cswords.txt

   • Adds hcxeiutool with -i <wordlist> to ingest a wordlist and split its entries into up to four character-class output files: -d (digits only), -x (hex digits only, deduped against digit-only and full-word lists), -c (alpha characters only), and -s (case-sensitive words, one per whitespace boundary).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Skips $HEX[…]-encoded entries automatically during wordlist processing, keeping output lists clean for downstream cracking tools.

   2 details in Everything

2. docs update Oct 10, 2026 · issue 101

   hcxtools adds FT-PSK support via hashcat hash mode 2200x and gains hashcat hash-copy format conversion in hcoutin⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • The new 22000 hash file format is not backwards compatible with hashcat builds before commit 6847f7793f9cf76a5f01dde85894e5645800a30f.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The new 22000 hash file format is not backwards compatible with hashcat builds before commit 6847f7793f9cf76a5f01dde85894e5645800a30f.
3. docs update Oct 10, 2026 · issue 101

   hcxtools: Adds support for FT-PSK (hash mode 2200x) in hcxtools, with all FT-PSK handling moved to this mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Increases AUTHLEN to 512 bytes, raising the authentication field size limit

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The new 22000 hash file format is not backwards compatible with previous versions
4. 2026-10-03 Oct 3, 2026 · release notes

   hcxpcapngtool adds support for hashcat 2200x FT-PSK EAPOL hashes and limits payload size to 512 bytes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-10-03 https://github.com/ZerBea/hcxtools.git
   # already have the repo? check out this version:
   $ git checkout 2026-10-03

   • Adds 2200x FT-PSK EAPOL hash mode support in hcxpcapngtool for generating hashcat-compatible output files
   • Sets a hard 512-byte EAPOL payload limit for hash mode 2200x in both hcxpcapngtool and hcxhastool

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The output format for hash mode 2200x is not backwards compatible with hashcat versions before commit 6847f7793f9c
   • !The --pmkid-client option in hcxpcapngtool has been removed as PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. client data is now merged directly into the standard PMKID output
5. docs update Aug 9, 2026 · issue 040

   hcxtools build system gains explicit curl, openssl, and zlib feature options in meson_options.txt

   └──▷ TRY IT
   Build hcxtools with only zlib support enabled for hcxpcapngtool, keeping curl and openssl disabled to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. on a stripped-down analysis host.
   copy

   $ meson setup build -Dcurl=disabled -Dopenssl=disabled -Dzlib=enabled

   • Adds curl feature option to meson_options.txt to selectively build tools relying on libcurl.
   • Adds openssl feature option to meson_options.txt to selectively build tools relying on OpenSSL.
   • Adds zlib feature option to meson_options.txt to enable zlib support specifically for hcxpcapngtool.

   3 details in Everything

6. 2026-03-25 Mar 25, 2026 · release notes

   hcxpcapngtool adds FT-PSK PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. and EAPOL conversion via new -f flag (hashcat mode 37100)

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-03-25 https://github.com/ZerBea/hcxtools.git
   # already have the repo? check out this version:
   $ git checkout 2026-03-25

7. 2026-01-22 Jan 22, 2026 · release notes

   hcxpottool renames its tab-separated output option to --tabspout and adds --tabnhout for output without hexification.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-01-22 https://github.com/ZerBea/hcxtools.git
   # already have the repo? check out this version:
   $ git checkout 2026-01-22

   • Renames the tab-separated output option to --tabspout, which hexifies characters below 0x20 or above 0x7e.
   • Adds --tabnhout flag to hcxpottool for tab-separated output with no hexification

   2 details in Everything

8. 2026-01-13 Jan 13, 2026 · release notes

   hcxtools introduces hcxpottool for converting mixed-encoding hashcat pot/out files to ASCII-hexified formats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026-01-13 https://github.com/ZerBea/hcxtools.git
   # already have the repo? check out this version:
   $ git checkout 2026-01-13

   • Adds hcxpottool, a CLI tool for converting mixed-encoding hashcat output and pot files to ASCII-compatible pot or tab-separated output by hexifying non-printable characters.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !hcxcommic has been removed; its functionality is now in hashcat (--hash-copy).
9. 2025-02-08 Feb 8, 2025 · release notes

   hcxtools adds --nmea-in and --nmea-offset flags to ingest NMEA 0183 GPS data.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025-02-08 https://github.com/ZerBea/hcxtools.git
   # already have the repo? check out this version:
   $ git checkout 2025-02-08

   • Adds --nmea-in=<file> flag to hcxpcapngtool for reading external NMEA 0183 GPS files
   • Adds --nmea-offset=<seconds> flag to hcxpcapngtool for specifying time offset between NMEA file and dump

   2 details in Everything

10. 2024-01-26 Jan 26, 2024 · release notes

    hcxpcapngtool introduces a new --lts CLI flag to export BSSID data for GPS synchronization.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2024-01-26 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2024-01-26

    • Adds the --lts=<file> option to hcxpcapngtool, allowing users to store a BSSID list formatted with Linux timestamp, AP MAC, and ESSID for synchronization with external GPS data

    1 detail in Everything

11. 2023-12-13 Dec 13, 2023 · release notes

    hcxhashtool adds --hccapx-in to import deprecated HCCAPX files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023-12-13 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2023-12-13

    • Adds --hccapx-in=<file> option to hcxhashtool for importing deprecated hccapx file input.
    • Changes the output options to --hccapx-out=<file> and --hccap-out=<file> for deprecated hccapx and ancient hccap formats.

    2 details in Everything

12. 6.3.2 Nov 1, 2023 · release notes

    hcxtools 6.3.2 adds a simple pattern generator based on wpa-sec analysis and new weak candidates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 6.3.2 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 6.3.2

    └──▷ USE IT
    Generate a list of likely weak passwords derived from the wpa-sec dataset.
    shell copy

    hcxpsktool --genpattern -o candidates.txt wpa_supplicant.conf

    • Adds --genpattern to generate simple passwords based on wpa-sec dictionary analysis

    1 detail in Everything

13. 2023-05-10 May 10, 2023 · release notes

    hcxpcapngtool adds --pmkid-client to export client PMKIDs and distinguishes source in WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.*01 output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023-05-10 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2023-05-10

    • Adds --pmkid-client=<file> flag to hcxpcapngtool to store PMKIDs from clients in a separate file for PSK recovery.
    • Includes the PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. source (access point vs. client) as a suffix (01 or 10) in the WPA*01 hash line format.

    2 details in Everything

14. 2022-12-24 Dec 24, 2022 · release notes

    hcxpcapngtool adds detection of entire RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. authentication flows

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022-12-24 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2022-12-24

    • hcxpcapngtool now detects RADIUS AUTHENTICATION (REQUEST), (CHALLENGE), and (ACCEPT) messages in PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files

    1 detail in Everything

15. 2021-09-01 Sep 1, 2021 · release notes

    New CLI capability to extract and export detailed hardware identification data from access points within processed captures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021-09-01 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2021-09-01

    • Adds -D <file> option to hcxpcapngtool to output a tab-delimited list of access points including MAC, MANUFACTURER, MODELNAME, SERIALNUMBER, DEVICENAME, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..

    1 detail in Everything

16. 2021-08-28 Aug 28, 2021 · release notes

    hcxtools adds verbose download progress indicators and detailed hash file inspection options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021-08-28 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2021-08-28

    • hcxhashtool output modes extended with stdout targets for --info and --info-vendor flags

    1 detail in Everything

17. 2021-08-27 Aug 27, 2021 · release notes

    hcxhashtool adds --vendor-ap and --vendor-client flags for targeted vendor filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021-08-27 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2021-08-27

    • Adds --vendor-ap=<VENDOR> flag to hcxhashtool for filtering Access Points by vendor name.
    • Adds --vendor-client=<VENDOR> flag to hcxhashtool for filtering Client devices by vendor name.

    2 details in Everything

18. 2021-03-17 Mar 17, 2021 · release notes

    hcxhashtool adds --mac-skiplist option to exclude specific MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. during processing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021-03-17 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2021-03-17

    • Adds --mac-skiplist=<file> flag to hcxhashtool to exclude MAC addresses from a file containing formats like 001122334455, 00:11:22:33:44:55, or 00-11-22-33-44-55.

    1 detail in Everything

19. 2021-02-28 Feb 28, 2021 · release notes

    hcxtools 2021-02-28 adds hcxpmktool to calculate PMKs and verify 22000 hashlines

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021-02-28 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2021-02-28

    • Adds hcxpmktool binary (version 6.1.5-72-g585fe37) for calculating a PMK and verifying a 22000 hashline

    1 detail in Everything

20. 2020-12-31 Dec 31, 2020 · release notes

    hcxpcapngtool gains a new CSV export feature for access point data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-12-31 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-12-31

21. 2020-10-27 Oct 27, 2020 · release notes

    Adds hcxeiutool to prepare hcxpcapngtool output for hashcat with rule support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-10-27 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-10-27

    └──▷ USE IT
    Generate specialized wordlists from an input list to be used with hashcat rules on captured handshake data.
    shell copy

    $ hcxeiutool -i elist -d digitlist -x xdigitlist -c charlist -s sclist

    • Adds the new hcxeiutool command-line tool to generate specialized wordlists (digit, xdigit, character) from an input list for use by hashcat.

    1 detail in Everything

22. 2020-10-13 Oct 13, 2020 · release notes

    hcxtools 2020-10-13 adds TACACS+ export and unified EAP LEAP/MSCHAPv2 support in hcxpcapngtool

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-10-13 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-10-13

    • --tacacs-plus=<file> output option added to hcxpcapngtool to export TACACS+ hashes (format 16100) for hashcat or John the Ripper.
    • --eapleap flag in hcxpcapngtool now covers both EAP LEAP and MSCHAPv2 CHALLENGE outputs (format 5500 / john netntlm), merging the previous separate options.

    2 details in Everything

23. 2020-09-18 Sep 18, 2020 · release notes

    hcxtools 2020-09-18 adds a new probing wordlist generation option to hcxpcapngtool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-09-18 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-09-18

    • Adds -R <file> option to hcxpcapngtool to output an autohex-enabled wordlist derived from PROBEREQUEST frames.

    1 detail in Everything

24. 2020-06-19 Jun 19, 2020 · release notes

    hcxpsktool adds --netgear and --askeyarris flags for targeted weak candidate filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-06-19 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-06-19

    • Adds --netgear flag to include weak NETGEAR / ORBI candidates in hcxpsktool
    • Adds --askeyarris flag to include weak MySpectrumWiFI / SpectrumSetup / MyCharterWiFI candidates in hcxpsktool

    2 details in Everything

25. 2020-05-20 May 20, 2020 · release notes

    hcxpcapngtool adds out-of-sequence timestamp warning and improved conversion speed.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-05-20 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-05-20

    • Adds a warning output in hcxpcapngtool when out-of-sequence timestamps are detected during processing
    • Improves conversion speed in hcxpcapngtool

    2 details in Everything

26. 6.0.0 Apr 2, 2020 · release notes

    hcxtools v6.0.0 adds hcxpcapngtool and full PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake.+EAPOL hashline support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 6.0.0 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 6.0.0

    • hcxpcapngtool: new standalone tool for processing pcapng captures
    • Full support of the new hashline format combining PMKID and EAPOL data (hashcat -m 22000 and JtR)

    2 details in Everything

27. 2020-01-05 Jan 5, 2020 · release notes

    hcxhashtool gains --info to dump hash contents and -d to download OUI data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020-01-05 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2020-01-05

    • Adds -d flag to hcxhashtool to download the IEEE OUI text file (standards-oui.ieee.org/oui.txt) into ~/.hcxtools/oui.txt
    • Adds --info=<file> and --info=stdout flags to hcxhashtool to output detailed information about the content of a specified hash file

    2 details in Everything

28. 2019-09-25 Sep 25, 2019 · release notes

    Adds hcxmactool for MAC-based filtering of PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. and HCCAPX hash files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-09-25 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-09-25

    • Adds hcxmactool as a new CLI binary (MAC based counterpart to ESSID based hcxessidtool).
    • Supports input/output of --pmkidin, --pmkidout, --hccapxin, and --hccapxout files for PMKID and HCCAPX formats.
    • Adds filtering flags to target specific access points or clients: -o, -n, -m, -a for APs; -O, -N, -M, -A for clients.

    3 details in Everything

29. 2019-09-24 Sep 24, 2019 · release notes

    hcxessidtool gains --pmkidgroupout and --hccapxgroupout to export ESSID groups from PMKID1 or HCCAPX1 inputs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-09-24 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-09-24

    • Adds --pmkidgroupout=<file> to hcxessidtool for outputting ESSID groups from ESSIDs present in PMKID1
    • Adds --hccapxgroupout=<file> to hcxessidtool for outputting ESSID groups from ESSIDs present in HCCAPX1

    2 details in Everything

30. 2019-09-12 Sep 12, 2019 · release notes

    hcxtools adds hcxessidtool CLI for merging and filtering ESSIDs from PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake./HCCAPX files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-09-12 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-09-12

    └──▷ USE IT
    Merge PMKID files from two captures into a joint hash set for cracking
    shell copy

    hcxessidtool --pmkid1=file1.16800 --pmkid2=file2.16800 --pmkidout12=joint.16800

    Filter PMKID file for specific ESSID length to reduce crack space
    shell copy

    hcxessidtool --pmkid1=file1.16800 -l 10 --pmkidout=filtered.16800

    • Adds hcxessidtool command-line utility to merge hash files by ESSID
    • Adds --pmkid1, --pmkid2, --pmkidout12, --pmkidout1, --pmkidout2, and --pmkidout options for PMKID file merging and filtering in hcxessidtool
    • Adds --hccapx1, --hccapx2, --hccapxout12, --hccapxout1, --hccapxout2, and --hccapxout options for HCCAPX file merging and filtering in hcxessidtool
    • Adds -e, -E, and -l filters to hcxessidtool for ESSID name and length constraints

    4 details in Everything

31. 2019-08-09 Aug 9, 2019 · release notes

    hcxpcaptool adds --replaycountcheck flag for filtering by WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. handshake validity

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-08-09 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-08-09

    • Adds --replaycountcheck option to hcxpcaptool to convert only frames verified by replaycount check.

    1 detail in Everything

32. 2019-06-23 Jun 23, 2019 · release notes

    hcxtools 2019-06-23 adds --prefix-out and --ignore-zeroed-pmks to hcxpcaptool

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-06-23 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-06-23

    • Adds --ignore-zeroed-pmks flag to hcxpcaptool to skip frames using a zeroed plainmasterkey (PMK)
    • Adds --prefix-out=<file> flag to hcxpcaptool to convert all supported list formats (hccapx, PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake., netntlm, md5, tacacsplus, wordlist, identitylist, usernamelist, imsilist, networklist, trafficlist, clientlist, deviceinfolist) using a single prefix

    2 details in Everything

33. 2019-06-16 Jun 16, 2019 · release notes

    Adds --ignore-fake-frames option to hcxpcaptool to detect and skip known fake frames.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-06-16 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-06-16

34. 2019-06-07 Jun 7, 2019 · release notes

    hcxtools 2019-06-07 adds --filtermac to hcxpcaptool for single-MAC output filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-06-07 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-06-07

    • hcxpcaptool gains the --filtermac=<mac> option to filter packets by a specific MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. (format: 112233445566).

    1 detail in Everything

35. 5.1.6 May 30, 2019 · release notes

    hcxtools 5.1.6 adds -K and -Z flags to hcxpcaptool for raw PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. output formats

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.1.6 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 5.1.6

    • Adds -K <file> option to hcxpcaptool to output raw PMKIDs in hashcat 16801 new format.
    • Adds -Z <file> option to hcxpcaptool to output raw PMKIDs in hashcat 16801 old format and John the Ripper.

    2 details in Everything

36. 2019-05-19 May 19, 2019 · release notes

    Adds hcxgrep.py script for grepping hccapx and pmkid hashfiles by ESSID, MAC AP, or MAC STA

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-05-19 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-05-19

    • hcxgrep.py automatically detects hccapx/pmkid hash files, reads from stdin, and writes to stdout.

    1 detail in Everything

37. 2019-04-02 Apr 2, 2019 · release notes

    hcxpcaptool adds -k for the new hashcat PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. format; hcxhashcattool converts legacy potfiles using -p and -P.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-04-02 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-04-02

    • hcxpcaptool -k <file> writes the PMKID capture to a file compatible with hashcat's new -m 16800 format
    • Use hcxhashcattool -p and -P to convert old hashcat 2500 or 16800 potfiles to the new PMK:ESSID:PSK format.

    2 details in Everything

38. 2019-03-07 Mar 7, 2019 · release notes

    hcxpcaptool now includes GPS time in the GPX comment field (<cmt>).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-03-07 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-03-07

    • Adds a <cmt> field to GPX output containing GPS-TIME:<timestamp> when processing data from a GPS device.

    1 detail in Everything

39. 2019-02-11 Feb 11, 2019 · release notes

    whoismac adds options to convert ESSIDs between ASCII and hexadecimal.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-02-11 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-02-11

    └──▷ TRY IT
    Convert an ASCII network name (e.g., default) to its hex representation for hashcat lookup.
    copy

    $ whoismac -e default

    • Adds whoismac -e <ESSID> option to convert an ASCII ESSID to HEX format.
    • Adds whoismac -x <xdigit> option to convert a HEX ESSID to ASCII format.

    2 details in Everything

40. 2019-02-01 Feb 1, 2019 · release notes

    hcxhash2cap now supports direct input from John the Ripper WPAPSK hashes via a new CLI flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-02-01 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-02-01

    • Adds --john=<file> so hcxhash2cap can convert John the Ripper WPAPSK hash files to cap files.

    1 detail in Everything

41. 2019-01-22 Jan 22, 2019 · release notes

    hcxpcaptool adds detection and counting of oversized EAPOL frames (>0xff bytes) for WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes. handshake analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019-01-22 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2019-01-22

    • hcxpcaptool now counts oversized (>0xff) EAPOL packets in prepared PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files.

    1 detail in Everything

42. 2018-12-13 Dec 13, 2018 · release notes

    hcxpcaptool adds --hccap-out and --hccap-raw-out to export legacy HCCAP formats for Hashcat.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-12-13 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-12-13

    • Adds --hccap-out=<file> option to output old hccap file (hashcat -m 2500)
    • Adds --hccap-raw-out=<file> option to output raw old hccap file (hashcat -m 2500)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -x and -X options for hcxpcaptool have been removed.
43. 2018-12-09 Dec 9, 2018 · release notes

    hcxpcaptool gains EAPOL group key detection and explicit output options for EAPOL, network info, and hexdumps

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-12-09 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-12-09

    • hcxpcaptool now detects EAPOL GROUP KEYs in captured traffic
    • Adds --eapol-out=<file> to output hexadecimal EAPOL packets in mac_ap:mac_sta:eapol format.
    • Adds --network-out=<file> to output network information in mac_ap:ESSID format
    • Moves the legacy -H flag to --hexdump-out=<file> for raw packet hex dumps

    4 details in Everything

44. 2018-09-29 Sep 29, 2018 · release notes

    hcxpcaptool adds -g flag to output GPX files for wireless location data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-09-29 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-09-29

    • hcxpcaptool now supports the new -g <file> option to export GPS coordinates in GPX format

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -Z option has been removed from hcxpcaptool
45. 2018-07-25 Jul 25, 2018 · release notes

    hcxpcaptool gains -m 16800/16801 support and -z/-Z PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. output flags for WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.*-PMKID attacks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-07-25 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-07-25

    • Adds -m 16800 (WPA*-PMKID-PBKDF2) and -m 16801 (WPA*-PMKID-PMK) hashmodes to hcxpcaptool
    • Adds -z <file> flag to output PMKID file in hashcat hashmode -m 16800 format
    • Adds -Z <file> flag to output PMKID file in hashcat hashmode -m 16801 format

    3 details in Everything

46. 4.1.5 Mar 12, 2018 · release notes

    hcxtools 4.1.5 adds wlancap2wpasec for uploading capture files to wpa-sec.stanev.org with key and timeout control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.5 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 4.1.5

    • Adds wlancap2wpasec command-line tool for processing WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-PSK captures via the wpa-sec API
    • Supports -k <key> option in wlancap2wpasec to provide a user-defined authentication key
    • Supports -u <url> option in wlancap2wpasec to target alternative WPA-sec endpoints (default: https://wpa-sec.stanev.org)
    • Supports -t <seconds> option in wlancap2wpasec to configure API connection timeout (default: 30)

    4 details in Everything

47. 2018-02-04 Feb 4, 2018 · release notes

    hcxtools adds EAP (RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure.) netNTLMv1 and MD5 challenge extraction options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-02-04 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-02-04

    • Adds -U flag to hcxpcaptool to output an unsorted username list
    • Adds --netntlm-out=<file> flag to hcxpcaptool for netNTLMv1 hash extraction (hashcat -m 5500, john netntlm)
    • Adds --md5-out=<file> flag to hcxpcaptool for MD5 challenge hash extraction (hashcat -m 4800, john chap)

    3 details in Everything

48. 2018-01-17 Jan 17, 2018 · release notes

    hcxpcaptool gains granular output formats (-O, -x, -X, -j, -J) and error correction flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-01-17 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-01-17

    • Adds -O <file> flag to hcxpcaptool to output a raw hccapx file for third-party tools that strip handshakes
    • Adds -x <file> and -X <file> flags to hcxpcaptool to output standard hccap and raw hccap files respectively, for use on older systems or hashcat versions
    • Adds -j <file> and -J <file> for John WPAPSK-PMK and raw John WPAPSK-PMK output.

    3 details in Everything

49. 2018-01-15 Jan 15, 2018 · release notes

    hcxtools adds -V verbose flag to hcxpcaptool for detailed status output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-01-15 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-01-15

50. 2018-01-12 Jan 12, 2018 · release notes

    hcxdumptool gains -C scanlist option; hcxpcaptool adds -A for AP anonce forensics output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-01-12 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-01-12

    • Adds -C <digit> flag to hcxdumptool for comma-separated channel scanlists (e.g. 1,3,5,7)
    • Adds -A <file> option to hcxpcaptool to output access point anonce information list in format date:mac_sta:mac_ap:keyver:replaycount:anonce

    2 details in Everything

51. 2018-01-09 Jan 9, 2018 · release notes

    Renames wlandump-rs to hcxdumptool and introduces hcxpcaptool with full pcapng support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018-01-09 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2018-01-09

    • Renamed wlandump-rs binary to hcxdumptool
    • Replaced wlancapinfo utility with hcxpcaptool which includes full pcapng format support

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The binary name wlandump-rs is renamed to hcxdumptool, requiring updates to scripts calling the old name.
    • !wlancapinfo is removed; users must migrate to hcxpcaptool for similar functionality.
52. 2017-12-17 Dec 17, 2017 · release notes

    Adds wlandump-rs, a raw-socket WLAN capture tool with channel hopping and AP blacklisting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2017-12-17 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2017-12-17

    • Introduces wlandump-rs, a new WLAN packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. utility using raw sockets instead of libpcap.
    • Supports automatic detection of channels 14 and 5GHz if the driver allows it.
    • Adds -B <file> flag to specify an AP blacklist for excluding specific hosts from deauthentication.
    • Adds -I flag to list suitable WLAN interfaces and exit.

    4 details in Everything

53. 2017-12-05 Dec 5, 2017 · release notes

    wlanhcx2ssid adds -F to strip damaged records from hccapx files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2017-12-05 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2017-12-05

    • wlanhcx2ssid gains -F <file> to strip bad records and write only flawless records to an hccapx file.

    1 detail in Everything

54. 2017-10-28 Oct 28, 2017 · release notes

    Merge wlanresponse into wlandump-ng with new passive defaults and capture control flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2017-10-28 https://github.com/ZerBea/hcxtools.git
    # already have the repo? check out this version:
    $ git checkout 2017-10-28

    • Merges wlanresponse and wlandump-ng so wlandump-ng now handles response logic
    • Adds -R flag to respond to all requests in wlandump-ng
    • Adds -D flag to enable deauthentication in wlandump-ng
    • Adds -d flag to enable disassociation in wlandump-ng
    • Adds -E <digit> to stop deauthentication and disassociation after the specified number of complete handshakes is received.

    +3 more show less

    • Adds -U flag to send undirected proberequest on channel change in wlandump-ng
    • Adds -B flag to enable beaconing on last proberequest in wlandump-ng
    • Adds -s flag to show status messages (waterfall) in wlandump-ng

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !wlanresponse binary is removed; use wlandump-ng instead
    • !wlandump-ng defaults to passive mode (only receive) requiring -D, -d, or -R for active operations