openwall / openwall/john

Adopt hcxtools' (and hashcat's) new unified WPA input line format

Open
#4,183 4 comments 3 reactions 1 assignee View on GitHub

@magnumripper is already working on this.

Since Dec 19, 2019.

enhancement portability
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

See https://github.com/hashcat/hashcat/issues/1816#issuecomment-566546059

The new format is:

SIGNATURE*TYPE*PMKID/MIC*MACAP*MACSTA*ESSID*ANONCE*EAPOL*MESSAGEPAIR

Some notes:

  • SIGNATURE = "WPA"
  • TYPE = 01 for PMKID, 02 for EAPOL, others to follow
  • PMKID/MIC = PMKID if TYPE==01, MIC if TYPE==02
  • MACAP = MAC of AP
  • MACSTA = MAC of station
  • ESSID = ESSID
  • ANONCE = ANONCE
  • EAPOL = EAPOL (SNONCE is in here)
  • MESSAGEPAIR = Bitmask:
0: MP info (https://hashcat.net/wiki/doku.php?id=hccapx)
1: MP info (https://hashcat.net/wiki/doku.php?id=hccapx)
2: MP info (https://hashcat.net/wiki/doku.php?id=hccapx)
3: x (unused)
4: ap-less attack (set to 1) - no nonce-error-corrections necessary
5: LE router detected (set to 1) - nonce-error-corrections only for LE necessary
6: BE router detected (set to 1) - nonce-error-corrections only for BE necessary
7: not replaycount checked (set to 1) - replaycount not checked, nonce-error-corrections definitely necessary

All fields are encoded in hex except SIGNATURE.

This is a great improvement to our old hack of simply Base-64 encoding the (deprecated) hccap struct.

A corresponding pot line in JtR will only contain ESSID and calculated PMK, something like

WPA*00*PMK***ESSID***:password

That is: TYPE is set to 00, next field is PMK and all other fields but ESSID are empty.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.