hcxdumptool and hcxtools: Modern WiFi Capture

What hcxdumptool and hcxtools Actually Do

hcxdumptool captures WiFi authentication frames. hcxtools converts those captures into formats that hashcat and John the Ripper can process. Together, they replace the capture-and-convert portion of the traditional aircrack-ng workflow with a more modern, more capable approach.

The "hcx" stands for hash conversion. The toolset was written by ZerBea and is actively maintained on GitHub. It is the current standard for WPA/WPA2 capture work in security research, particularly because of its ability to capture PMKID hashes without disconnecting any clients from the target network.

The toolset has two main components:

• hcxdumptool - the capture tool. It puts your WiFi adapter into monitor mode, sends targeted management frames, and collects authentication material (PMKID and EAPOL frames).
• hcxtools - the conversion toolkit. The main binary is hcxpcapngtool, which reads pcapng capture files and extracts hashes in hashcat-compatible format (mode 22000 for WPA/WPA2).

There are several other utilities in hcxtools for filtering, analyzing, and manipulating captures, but hcxpcapngtool is the one you will use most.

graph LR
    subgraph hcxdumptool
        A[WiFi Adapter] --> B[Monitor Mode]
        B --> C[Send Association Requests]
        C --> D[Capture PMKID from AP]
        B --> E[Listen for Handshakes]
        E --> F[Capture EAPOL Frames]
    end
    D --> G[pcapng File]
    F --> G
    subgraph hcxtools
        G --> H[hcxpcapngtool]
        H --> I[hashcat mode 22000]
        H --> J[John the Ripper format]
    end
    I --> K[hashcat Cracking]
    J --> L[John Cracking]

Why Not Just Use aircrack-ng?

aircrack-ng works fine and has been the standard for over a decade. But hcxdumptool solves several problems with the traditional workflow:

1. No deauthentication required for PMKID. The classic aircrack-ng approach requires sending deauth frames to kick a client off the network, then capturing the 4-way handshake when the client reconnects. This is disruptive - it drops the client's connection. With hcxdumptool, you can capture the PMKID from the access point's first message in the handshake without any client needing to be present or disconnected. You send an association request to the AP, and if it supports PMKID (most modern routers do), it responds with the PMKID in the first EAPOL message.

2. Better capture format. hcxdumptool writes pcapng (the newer PCAP format) which supports annotations, interface metadata, and timestamps more accurately than the legacy pcap format that airodump-ng produces.

3. Direct hashcat integration. hcxpcapngtool outputs directly in hashcat mode 22000 format, which handles both PMKID and full handshake hashes in a single hash type. The old workflow required converting between multiple formats (cap to hccapx, or cap to hccap), and the hash modes were split between 2500 (handshake) and 16800 (PMKID).

4. Active probing. hcxdumptool actively probes access points to trigger PMKID responses. aircrack-ng's capture tools are passive - they wait for handshakes to happen naturally (or after a deauth).

The WPA2 4-way handshake - hcxdumptool can capture the PMKID from Message 1 alone, without needing the full exchange (Wikimedia Commons)

PMKID Capture: The No-Deauth Approach

PMKID (Pairwise Master Key Identifier) is a hash value that the access point includes in the first message of the 4-way handshake. It is calculated as:

PMKID = HMAC-SHA1-128(PMK, "PMK Name" + MAC_AP + MAC_Client)

The PMK itself is derived from the WiFi password and the SSID. So if you have the PMKID, you can attempt to crack the password offline by computing candidate PMKIDs from a wordlist and comparing.

The critical advantage: you do not need a connected client. The AP generates the PMKID using its own MAC and the MAC of whoever is associating - which can be you. hcxdumptool sends a legitimate association request to the target AP, receives Message 1 containing the PMKID, and captures it. No client gets disconnected. No deauth frames are sent.

Not every AP supports PMKID. Older routers and some enterprise configurations do not include it. But the majority of consumer routers manufactured after 2018 do. hcxdumptool will try PMKID first and fall back to capturing traditional handshakes if PMKID is not available.

Note: PMKID capture and all WiFi testing discussed here should only be performed on networks you own or have explicit written authorization to test.

The Tool Breakdown

The hcxtools package includes several binaries. The ones you will actually use:

• hcxpcapngtool - converts pcapng captures to hashcat/JtR format. This is the main conversion tool.
• hcxhashtool - filters and manipulates hash files (extract by ESSID, BSSID, etc.)
• hcxpsktool - generates candidate PSK lists based on common router default password patterns
• hcxeiutool - manages ESSID, identifier, and username lists
• hcxwltool - wordlist processing utilities

And hcxdumptool itself, which is a separate package:

• hcxdumptool - the capture binary. Requires a WiFi adapter with monitor mode and packet injection support.

Installation on Kali/Debian:

sudo apt install hcxdumptool hcxtools

For the latest version, compile from source:

git clone https://github.com/ZerBea/hcxdumptool.git
cd hcxdumptool
make
sudo make install

git clone https://github.com/ZerBea/hcxtools.git
cd hcxtools
make
sudo make install

The Capture Workflow

A basic capture session:

1. Identify your wireless interface:

ip addr
# Look for your external USB adapter, usually wlan0 or wlan1

2. Start hcxdumptool:

sudo hcxdumptool -i wlan0 -o capture.pcapng --active_beacon --enable_status=15

The flags:

• -i wlan0 - the wireless interface (hcxdumptool handles monitor mode itself)
• -o capture.pcapng - output file
• --active_beacon - send beacon frames to discover hidden networks
• --enable_status=15 - show all status messages (PMKID found, handshake captured, etc.)

3. Let it run. hcxdumptool cycles through channels automatically, sending association requests to every AP it finds. When it gets a PMKID or captures a full handshake, it reports it in the status output. A typical capture session runs for 5-15 minutes to cover all channels.

4. Stop with Ctrl+C when you have enough captures.

WiFi authentication involves an exchange between client and AP - hcxdumptool intercepts and captures these authentication frames (Wikimedia Commons)

Converting Captures for hashcat

After capturing, convert the pcapng file to hashcat format:

hcxpcapngtool -o hashes.22000 capture.pcapng

This produces a file containing hashes in hashcat mode 22000 format. Each line represents either a PMKID or a full handshake hash. The format looks like:

WPA*02*PMKID*MAC_AP*MAC_CLIENT*ESSID*...

Then crack with hashcat:

hashcat -m 22000 hashes.22000 /path/to/wordlist.txt

hashcat mode 22000 is the unified WPA hash mode - it handles both PMKID and full handshake hashes in the same run. This replaced the older modes 2500 (handshake only) and 16800 (PMKID only).

For John the Ripper, use:

hcxpcapngtool -j hashes.john capture.pcapng
john --wordlist=/path/to/wordlist.txt hashes.john

flowchart TD
    A[hcxdumptool captures pcapng] --> B[hcxpcapngtool]
    B --> C{Hash Type?}
    C -->|PMKID| D["WPA*01*... (PMKID hash)"]
    C -->|Full Handshake| E["WPA*02*... (EAPOL hash)"]
    D --> F[hashcat -m 22000]
    E --> F
    F --> G{Wordlist Attack}
    G -->|Match Found| H[Password Recovered]
    G -->|No Match| I[Try Rules / Larger Wordlist]
    I --> J[hashcat -m 22000 -r rules/best64.rule]
    J --> G
    B --> K[hcxhashtool --essid=TargetNetwork]
    K --> L[Filtered hashes for single target]
    L --> F

The complete capture-to-crack pipeline - from raw pcapng through hash extraction and filtering to password recovery with hashcat.

Filtering and Targeting

By default, hcxdumptool captures from every AP it can reach. For authorized testing of a specific network, you want to filter:

Target by BSSID (during capture):

# Create a filter file with target BSSIDs (one per line, no colons)
echo "aabbccddeeff" > targets.txt
sudo hcxdumptool -i wlan0 -o capture.pcapng --filterlist_ap=targets.txt --filtermode=2

--filtermode=2 means only capture from the listed APs. Mode 1 would exclude the listed APs (blacklist).

Filter by ESSID (after capture):

hcxhashtool --essid=TargetNetwork -i hashes.22000 -o filtered.22000

This extracts only the hashes for the network named "TargetNetwork" from your hash file.

Generate targeted wordlists:

hcxpsktool -o candidates.txt -e TargetNetwork

hcxpsktool generates candidate passwords based on common router default patterns. Many ISP-provided routers use predictable password formats - hcxpsktool knows these patterns and generates targeted candidates that are far more efficient than brute force.

A Complete Example

Here is a full authorized test workflow:

# 1. Start targeted capture
echo "aabbccddeeff" > /tmp/target.txt
sudo hcxdumptool -i wlan0 -o /tmp/capture.pcapng \
  --filterlist_ap=/tmp/target.txt --filtermode=2 \
  --active_beacon --enable_status=15

# 2. Wait for PMKID or handshake (watch status output)
# Press Ctrl+C when captured

# 3. Convert to hashcat format
hcxpcapngtool -o /tmp/hashes.22000 /tmp/capture.pcapng

# 4. Check what was captured
cat /tmp/hashes.22000 | wc -l
# Each line = one hash (PMKID or handshake)

# 5. Generate targeted candidates
hcxpsktool -o /tmp/candidates.txt -e MyTestNetwork

# 6. Run hashcat with candidates first, then wordlist
hashcat -m 22000 /tmp/hashes.22000 /tmp/candidates.txt
hashcat -m 22000 /tmp/hashes.22000 /path/to/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

WiFi networks involve multiple devices communicating through an access point - hcxdumptool captures the authentication exchanges between them (Wikimedia Commons)

How BLEShark Nano Fits In

The BLEShark Nano captures WPA2 handshakes directly and saves them as PCAP files. The capture happens on the device itself - you do not need a laptop, a USB WiFi adapter, or monitor mode drivers. Walk into range, start the capture, and the Nano handles the rest.

Once you have the PCAP file from the Nano, transfer it to your Linux machine and run it through hcxpcapngtool the same way:

hcxpcapngtool -o hashes.22000 bleshark_capture.pcap
hashcat -m 22000 hashes.22000 wordlist.txt

The Nano is particularly useful for situations where carrying a laptop is impractical. Site surveys, quick checks of client networks, or testing your own home router - the Nano fits in your pocket and captures the material you need. The analysis happens later on your workstation.

With the Shiver mesh network, you can deploy multiple Nano nodes across a site. Each node captures handshakes independently on its assigned channels through coordinated channel partitioning. At the end of the assessment, collect the PCAPs from each node and merge them for analysis. This gives you coverage across the entire 2.4GHz band without needing multiple laptops or USB adapters.

In the EU, the BLEShark Nano's handshake capture operates in passive-listen mode only - it does not send deauthentication frames, in compliance with RED regulations. This means it waits for naturally occurring handshakes rather than forcing reconnections.

Get the BLEShark Nano - $36.99+