HCXPCAPNGTOOL(1)

📦
version 7.1.2 · 6 versions
, in ubuntu stonking

💖 NAME 💖

hcxpcapngtool — the hcx tools set, bestie. it's a User Commands page, so you know it's the real deal 🫶

✨ DESCRIPTION ✨

okay so. hcxpcapngtool 7.1.2 (C) 2026 ZeroBeat — and what it does is convert pcapng, pcap and cap files to hash formats that hashcat and JtR use. no cap, that's the whole vibe. it's giving "glow up your packet dump into something a cracker can actually eat" 💅

here's how you call it, fr fr:

hcxpcapngtool <options>
hcxpcapngtool <options> input.pcapng
hcxpcapngtool <options> *.pcapng
hcxpcapngtool <options> *.pcap
hcxpcapngtool <options> *.cap
hcxpcapngtool <options> *.*

like, you can hand it ONE file, or you can hand it a whole glob of files, and it just ✨goes✨

🎀 short options 🎀

  • -o <file> — output WPA-PBKDF2-PMKID+EAPOL hash file (hashcat -m 22000). this is the main character option, ngl. it lets you get full advantage of reuse of PBKDF2 on PMKID and EAPOL 🔥
  • -E <file> — output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker. retrieved from every frame that contain an ESSID. every single one, she's thorough 💖
  • -R <file> — output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker. retrieved from PROBEREQUEST frames only. so, the picky version of -E, lowkey
  • -I <file> — output unsorted identity list to use as input wordlist for cracker
  • -U <file> — output unsorted username list to use as input wordlist for cracker
  • -D <file> — output device information list. the format is literally:
MAC MANUFACTURER MODELNAME SERIALNUMBER DEVICENAME UUID ESSID

that's the whole lineup, in that order, don't play 🙈

  • -h — show this help
  • -v — show version

🌈 long options 🌈

  • --all — convert all possible hashes instead of only the best one. bestie, heads up: that can lead to much overhead hashes. use hcxhashtool to filter hashes need hashcat --nonce-error-corrections >= 8
  • --eapoltimeout=<digit> — set EAPOL TIMEOUT (milliseconds). default: 5000 ms ⏱️
  • --nonce-error-corrections=<digit> — set nonce error correction. warning: values > 0 can lead to uncrackable handshakes 😭 default: 0
seriously, that warning is not me being dramatic. it says it right there. values greater than 0 can make your handshakes uncrackable. periodt.
  • --ignore-ie — do not use CIPHER and AKM information. this will convert all frames regadless of CIPHER and/OR AKM information, and can lead to uncrackable hashes. she's chaotic, proceed with caution 💀
  • --max-essids=<digit> — maximum allowed ESSIDs. default: 1 ESSID. it will disregard ESSID changes and take ESSID with highest ranking 👑
  • --eapmd5=<file> — output EAP MD5 CHALLENGE (hashcat -m 4800)
  • --eapmd5-john=<file> — output EAP MD5 CHALLENGE (john chap)
  • --eapleap=<file> — output EAP LEAP and MSCHAPV2 CHALLENGE (hashcat -m 5500, john netntlm)
  • --tacacs-plus=<file> — output TACACS PLUS v1 (hashcat -m 16100, john tacacs-plus)
  • --nmea-in=<file> — input NME 0183 file. to convert gpx to NMEA 0183, use GPSBabel:
gpsbabel -w -t -i gpx -f in_file.gpx -o nmea -F out_file.nmea
  • --nmea-out=<file> — output GPS data in NMEA 0183 format. format: NMEA 0183 $GPGGA, $GPRMC, $GPWPL. to convert it to gpx, use GPSBabel:
gpsbabel -i nmea -f hcxdumptool.nmea -o gpx,gpxver=1.1 -F hcxdumptool.gpx

to display the track, open file.gpx with viking 🗺️

  • --csv=<file> — output ACCESS POINT information in CSV format. delimiter: tabulator (0x08). columns:
YYYY-MM-DD HH:MM:SS MAC_AP ESSID ENC_TYPE CIPHER AKM COUNTRY_INFO CHANNEL RSSI GPS(DM.m) GPS(D.d) GPSFIX SATCOUNT HDOP ALTITUDE UNIT

GPS FIX values, listen up:

  • 0 = fix not available or invalid
  • 1 = fix valid (GPS SPS mode)
  • 2 = fix valid (differential GPS SPS Mode)
  • 3 = not supported
  • 4 = not supported
  • 5 = not supported
  • 6 = fix valid (Dead Reckoning Mode)

to convert it to other formats, use bash tools or scripting languages 🐚

  • --log=<file> — output logfile
  • --raw-out=<file> — output frames in HEX ASCII. format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM
  • --raw-in=<file> — input frames in HEX ASCII. format: TIMESTAMP*LINKTYPE*FRAME*CHECKSUM
  • --lts=<file> — output BSSID list to sync with external GPS data. format: LINUX timestamp <tab> RSSI <tab> MAC_AP <tab> ESSID
  • --pmkid-client=<file> — output WPA-(MESH/REPEATER)-PMKID hash file (hashcat -m 22000)
  • --pmkid=<file> — output deprecated PMKID file (delimiter *)
  • --hccapx=<file> — output deprecated hccapx v4 file
  • --hccap=<file> — output deprecated hccap file
  • --john=<file> — output deprecated PMKID/EAPOL (JtR wpapsk-opencl/wpapsk-pmk-opencl)
  • --prefix=<file> — convert everything to lists using this prefix (overrides single options). and the list it makes is:
    • -o <file.22000> — output PMKID/EAPOL hash file
    • -E <file.essid> — output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker
    • -I <file.identity> — output unsorted identity list to use as input wordlist for cracker
    • -U <file.username> — output unsorted username list to use as input wordlist for cracker
    • --eapmd5=<file.4800> — output EAP MD5 CHALLENGE (hashcat -m 4800)
    • --eapleap=<file.5500> — output EAP LEAP and MSCHAPV2 CHALLENGE (hashcat -m 5500, john netntlm)
    • --tacacs-plus=<file.16100> — output TACACS+ (hashcat -m 16100, john tacacs-plus)
    • --nmea=<file.nmea> — output GPS data in NMEA 0183 format
  • --add-timestamp — add date/time and EAPOL TIME gap (time between two EAPOL MESSAGEs in nsec) to hash line. this must be filtered out before feeding hashcat with the hash, e.g. by awk:
cat hash.hc22000 | awk '{print $1}' > hashremovedtimestamp.hc22000
  • --help — show this help
  • --version — show version

🦋 bitmask of PMKID hash line (WPA*01) message pair field 🦋

okay so this is the little legend for that field, one bit at a time:

  • 0: reserved
  • 1: PMKID taken from AP
  • 2: PMKID taken from AP possible PSKSHA256 FT using PSK
  • 3: reserved
  • 4: PMKID taken from CLIENT (wlan.da: possible MESH or REPEATER)
  • 5: reserved
  • 6: reserved
  • 7: reserved

🧚 bitmask of EAPOL hash line (WPA*02) message pair field 🧚

field 2,1,0:

  • 000 = M1+M2, EAPOL from M2 (challenge - ANONCE from M1)
  • 001 = M1+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed
  • 010 = M2+M3, EAPOL from M2 (authorized - ANONCE from M3)
  • 011 = M2+M3, EAPOL from M3 (authorized) - usable by option --all
  • 100 = M3+M4, EAPOL from M3 (authorized) - usable by option --all
  • 101 = M3+M4, EAPOL from M4 (authorized) - usable if NONCE_CLIENT is not zeroed

and then the upper bits:

  • 3: reserved
  • 4: NC (set to 1) - nonce-error-corrections deactivated on M1M2ROGUE, M2M3E3 and M3M4E3
  • 5: LE router detected (set to 1) - nonce-error-corrections required only on LE
  • 6: BE router detected (set to 1) - nonce-error-corrections required only on BE
  • 7: NC (set to 1) - nonce-error-corrections activated

🌸 THE RULES, BESTIE 🌸

Do not edit, merge or convert pcapng files! This will remove optional comment fields!
Detection of bit errors does not work on cleaned dump files!
Do not use hcxpcapngtool in combination with third party cap/pcap/pcapng cleaning tools (except: tshark and/or Wireshark)!

It is much better to run gzip to compress the files. Wireshark, tshark and hcxpcapngtool will understand this. like, she gets it. she's not gonna make it weird 🫶

Output is appended to existing files. so don't be shocked when your file is bigger than you expected, okay?

  • Recommended tools to show additional 802.11 fields or to decrypt WiFi traffic: Wireshark and/or tshark
  • Recommended tool to filter converted hash by several options: hcxhashtool
  • Recommended tool to get default or standard PSKs: hcxpsktool
  • Recommended tool to calculate wordlists based on ESSID: hcxeiutool
  • Recommended tools to retrieve PSK from hash: hashcat, JtR

and that's the whole page, bestie — mwah 💋

this was hcxpcapngtool 7.1.2, (C) 2026 ZeroBeat, dated July 2026, filed under HCXPCAPNGTOOL(1). go convert something iconic 👑💅

📦 where this page comes from