pmkidcap

Documentation

Overview

Package pmkidcap extracts WPA/WPA2 PMKID hashes from an 802.11 packet capture and emits ready-to-crack hashcat mode-22000 lines.

The clientless PMKID attack is the dominant modern WPA2 capture: a single EAPOL message-1 frame from the AP carries the PMKID in an RSN PMKID KDE, so a crackable hash is recovered with no client handshake. The canonical pcap → .hc22000 converter is hcxpcapngtool (a third-party C binary marauder_handoff shells out to). This does the PMKID case natively, in pure Go, by composing the in-tree decoders: the pcap reader (internal/pcap), the 802.11 frame parser (internal/ieee80211 — DS-bit-correct addresses and the QoS/+HTC-correct body offset), the EAPOL-Key dissector (internal/eapol — the PMKID KDE), and the mode-22000 line builder (internal/hashcat, anchored on hashcat's example).

Both container formats are handled: classic libpcap and pcapng (the format Marauder / hcxdumptool actually write), each carrying 802.11 with or without a radiotap header.

No confidently-wrong output: only 802.11 / radiotap link types are decoded (link type 105 / 127); a PMKID is taken only from an EAPOL message-1 with unencrypted key data and a 16-byte RSN PMKID KDE; the all-zero PMKID hostapd sends when none is available is dropped (not crackable); and the ready-to-crack line is built only once the network's ESSID has been seen in a beacon / probe-response / association-request (a PMKID with no ESSID is reported, but no line is fabricated for it).

Wrap-vs-native: native — orchestration over in-tree decoders (the libpcap and pcapng readers, the 802.11 parser, the EAPOL dissector, the hashcat builder) plus a fixed LLC/SNAP + EtherType check; stdlib only, no new go.mod dependency. The EAPOL 4-way (type-02) handshake is deferred (it needs M1–M4 pairing).

Index

• type Entry
• type Result
  • func Extract(capture []byte) (*Result, error)

Types

type Entry

type Entry struct {
	PMKID      string `json:"pmkid"`
	BSSID      string `json:"bssid"`
	StationMAC string `json:"station_mac"`
	// ESSID is the network name, resolved from a beacon / probe-response /
	// association-request seen in the same capture; empty when not seen.
	ESSID string `json:"essid,omitempty"`
	// HC22000Line is the ready-to-crack hashcat mode-22000 line, built only when
	// the ESSID is known.
	HC22000Line string `json:"hc22000_line,omitempty"`
	Note        string `json:"note,omitempty"`
}

Entry is one recovered PMKID.

type Result

type Result struct {
	Format       string  `json:"format"`
	LinkType     string  `json:"link_type"`
	Packets      int     `json:"packets"`
	NetworksSeen int     `json:"networks_seen"`
	PMKIDs       []Entry `json:"pmkids"`
	HashcatCmd   string  `json:"hashcat_command,omitempty"`
	Note         string  `json:"note"`
}

Result is the outcome of a capture scan.

func Extract

func Extract(capture []byte) (*Result, error)

Extract scans an 802.11 capture for clientless PMKIDs and emits ready-to-crack hashcat mode-22000 lines. Both classic libpcap and pcapng (the format Marauder / hcxdumptool write) containers are accepted.