Tool for capturing WLAN traffic and dumping PMKID and handshake captures for offline WPA cracking with hashcat.
hcxdumptool -i {interface} -o {output} 🌍 interface → wlan0mon 🌍 output → capture.pcapng hcxdumptool -i {interface} -o {output}Sandbox: execFile · Timeout: 86400s
network.capture.pmkid network.capture.handshake network.sniff | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
interface | string | Yes | - | Wireless interface in monitor mode | -i, --interface |
output | string | No | - | Output file path | -o, --output |
channel | string | No | - | Channel list to hop | -c, --channel |
timeout | integer | No | - | Timeout in seconds | -t, --timeout |
enable_status | boolean | No | - | Enable real-time status display | --enable_status |
disable_deauth | boolean | No | - | Disable deauth detection | --disable_deauth |
disable_assoc | boolean | No | - | Disable association detection | --disable_assoc |
disable_probe | boolean | No | - | Disable probe request capture | --disable_probe |
essid | string | No | - | Filter by ESSID | -E, --essid |
bssid | string | No | - | Filter by BSSID | -B, --bssid |
write | string | No | - | Write raw packets to file | -w, --write |
read | file | No | - | Read from capture file | -r, --read |
v | boolean | No | - | Verbose output | -v, --verbose |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
wireless.capture.pcapng | Captured WLAN traffic | application/vnd.tcpdump.pcap | - | verified |
wireless.capture.pmkid | PMKID hashes for cracking | text/plain | - | verified |
Inputs
wireless.interface Wireless interface in monitor mode
wireless.channel Target channel
wireless.bssid Target AP BSSID
Outputs
wireless.capture.pcapng Raw packet capture
wireless.capture.pmkid PMKID hash file
raw_socket_accessnetwork_traffic Produces
wireless.capture.pcapngwireless.capture.pmkidConsumes
wireless.interfacewireless.channelwireless.bssid| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 128 MB |
| Network | low |
| Disk I/O | high |
Capture on all channels
hcxdumptool -i wlan0mon -o capture.pcapngCapture specific channel with status
hcxdumptool -i wlan0mon -o capture.pcapng -c 6 --enable_statusFilter by BSSID
hcxdumptool -i wlan0mon -o capture.pcapng -B 00:11:22:33:44:55Filter by ESSID
hcxdumptool -i wlan0mon -o capture.pcapng -E MyNetworkDisable deauth detection
hcxdumptool -i wlan0mon -o capture.pcapng --disable_deauthCapture with timeout
hcxdumptool -i wlan0mon -o capture.pcapng -t 300Read from existing capture
hcxdumptool -r capture.pcapngDisable unnecessary detections
hcxdumptool -i wlan0mon -o capture.pcapng --disable_deauth --disable_assoc --disable_probehcxdumptool captures WLAN traffic and extracts PMKID (RSN PMKID) hashes and WPA handshakes for offline cracking with hashcat or John the Ripper.
The PMKID attack does not require a full EAPOL 4-way handshake — only a single packet from the AP is needed. This makes it faster and more reliable than traditional deauth-based handshake capture.