staz0t / hashcatch

Capture handshakes of nearby WiFi networks automatically

hashcatch

Hashcatch deauthenticates clients connected to all nearby WiFi networks and tries to capture the handshakes. It can be used in any linux device including Raspberry Pi and Nethunter devices so that you can capture handshakes while walking your dog

Written by @SivaneshAshok

PoC of hashcatch (running with a couple of WiFi networks within range)

Install from source

1. git clone https://github.com/staz0t/hashcatch
2. Install the prerequisites and ensure that they are working properly
3. [optional] Add the hashcatch directory to your PATH
4. ./hashcatch --setup
5. Answer the prompts
6. And done!

Install using packages

1. Download the respective package for your distribution from releases
2. Run sudo pacman -U ./hashcatch-<ver>-1-any.pkg.tar.xz or sudo apt install ./hashcatch_<ver>_all.deb
3. sudo hashcatch --setup
4. Answer the prompts
5. And done!

Prerequisites

• aircrack-ng
• hashcat-utils
• hcxtools
• jq

Usage

sudo hashcatch to start hashcatch

hashcatch --help to print the help screen

• Hashcatch runs indefinitely until keyboard interrupt
• Handshakes captured will be stored in /usr/share/hashcatch/handshakes/
• The captured WiFi network's BSSID and ESSID will be added to /usr/share/hashcatch/db
• If you're targeting a wifi network, spend around 20 to 30 seconds within the wifi's range to ensure handshake capture
• [Experimental] If you are connected to the internet while capturing, the following data will also be added to the db file
  • latitude
  • longitude
  • signal radius
  • time of record
  • Note: Kudos to Alexander Mylnikov for the API he's running that returns the location details of a router's MAC address using public databases

The Configuration file

• The configuration file can be found in /etc/hashcatch/hashcatch.conf
• You can later edit the "interface" field to set the interface of your choice
• You can also add an "ignore" field to mention the WiFi networks you want hashcatch to ignore while running
• Refer the example given below to know about the format in which entries should be added to the configuration file
• Format option name=option1,option2,option3
• No space in between option name, equal sign and options
• Example

interface=wlan0
ignore=Google Starbucks,AndroidAP

Features to be added

• More location features
• Automatic upload to websites to start cracking the handshake

Known Issues

1. [OSX] From issues raised by users, it seems airodump-ng is not working properly in OSX. Since it is a dependency for hashcatch, OSX users might not be able to run hashcatch.

Note: PMKID attack is not included in hashcatch because not all routers are vulnerable to the attack, hence checking for the attack increases the time taken in testing one AP. Pixiedust attack, and collecting information via WPS while being effective, in a targetted attack, it also increases the time takes in testing one AP, which is not ideal for the mission of this tool, which is to be as fast as possible. Besides that, in my testing I found that there is one WPS enabled router for every 10 APs. Hence, the result provided by hashcatch will not be consistent and it can miss out on an oppurtunity to capture an extra handshake. So, as of now, hashcat will continue working with the conventional deauth and capture method.

PS: Even though I was working on hashcatch few days before @evilsocket posted about his pwnagotchi, his work has definitely been an inspiration for this project!

hashcatch's Issues

Hashcatch not starting

Hi guys, I am running into an issue getting hashcatch to run. all prerequisites are installed.

This is screen I am getting:

[] Starting hashcatch setup
ls: cannot access '/usr/share/hashcatch/handshakes/': No such file or directory
[] Enter your wireless interface: wlan1
[] Trying to set the given interface to monitor mode
[+] The adapter is working in monitor mode!
./hashcatch: line 88: /etc/hashcatch/hashcatch.conf: No such file or directory
[] All necessary packages are found installed
[*] Done

Please help.
Running on 4.19.0-kali4-amd64

Thanks!

Monitor mode check during setup fails

Hi,
im trying to install hashcatch via cloning the git repo and "./hashcatch --setup" on Kali (Linux kali 5.6.0-kali1-amd64 #1 SMP Debian 5.6.7-1kali1 (2020-05-12) x86_64 GNU/Linux).
My card is an Alfa AWUS051NH which supports monitor mode but the setup checkup fails:
phy2 wlan0 rt2800usb Ralink Technology, Corp. RT3572

[*] Enter your wireless interface: wlan0
[*] Trying to set the given interface to monitor mode
[-] Could not set the given wireless adapter to monitor mode!
[-] Enter another wireless interface to try again:

after that check, the card is in monitor mode:

root@kali:/home/kali/Desktop# iwconfig

wlan0     IEEE 802.11  Mode:Monitor  Frequency:2.412 GHz  Tx-Power=20 dBm   
          Retry short  long limit:2   RTS thr:off   Fragment thr:off
          Power Management:off

deactivating the monitor mode via airmon-ng brings up following message:

root@kali:/home/kali/Desktop# airmon-ng stop wlan0

PHY     Interface       Driver          Chipset

phy2    wlan0           rt2800usb       Ralink Technology, Corp. RT3572

You already have a wlan0 device but it is NOT in station mode.
Whatever you did, don't do it again.
Please run "iw wlan0 del" before attempting to continue

Feels like the setup check is doing something no "ok"?

macOS - en0 monitor mode

"[-] Could not set the given wireless adapter to monitor mode!"

All of the pre-requisite software runs fine in macOS so it seems ( I could be wrong ) that macOS support should be possible. I look forward to future updates. Thanks for all the hard work.

Using macOS version 10.14.6 (18G87).

Hashcat-utils

I have read all other reports and solutions to this problem but I still get the problem. Might be because I dont understand the solutions. Can you help me out, thanks

Missing hashcat-utils

I am trying to setup hashcatch to run on my kali linux, followed the steps as instructed. Hashcatch recognizes my network adapter and successfully puts it into monitor mode. At the next step setup quits, because its missing hashcat-utils. I've been searching for a fix, but can't figure out how to make it to install.

What I've tried
changing the $PATH variable - i added both /usr/lib/hashcat-utils/ and usr/share/hashcat-utils folders, which later i found out are the same. Tried to change $path only on current shell and then also tried to change the .bashrc file. I also tested if the paths are properly added with echo $PATH, both folders always appear even after reboot.
I have all other dependecies which are aircrack-ng, hcxtools and jq, which i check with command -v <command_name>
I've also tried putting the ~/lib/hashcat-utils/ folder into /usr/bin/
I can't figure it out please help me

Missing Hashcat-utils fix

I have been trying to use this tool for a little wondering why cap2hccapx wont work. And the reason is the way I installed and prob many other people installed hashcat-utils the file ends in .bin so cap2hccapx.bin works not cap2hccapx so in the code its self just replace cap2hccapx with cap2hccapx.bin

Can't run hashcatch on pi w zero

Hey so while running hashcatch on raspbian, on my raspberry pi zero W it can never connect the wifi device to monitor mode,

doing the command
"iw list"
shows the supported interfaces of the pi's wifi card
monitor mode doesn't show up
available ones are:
IBSS
MANAGED
AP
P2P-CLIENT
P2P-GO
PDP-DEVICE
is there a way to fix?

Logical bug?

Hello! In the string:
cap2hccapx "/tmp/hc_captures/$bssid-01.cap" "/tmp/hc_handshakes/$bssid.hccapx" &> /dev/null
the script checks the *-01.cap file permanently. Even if there are new captures, the script will test only the first one. So it makes impossible to catch a handshake if in the first capture it is absent.

So to fix it, we should replace the string with something like:
cap2hccapx "`ls /tmp/hc_captures/$bssid-*.cap | tail -n 1`" "/tmp/hc_handshakes/$bssid.hccapx" &> /dev/null

Or instead to add
rm "/tmp/hc_captures/$bssid-01.cap"
just after
rm "/tmp/hc_handshakes/$bssid.hccapx" &> /dev/null

test mode monitor before continue

hello after interface grep you can add this lines

mode=$(iwconfig wlan0 | head -n 1 | awk -F" " '{print $4}' | awk -F":" '{print $2}')
if [ "$mode" != "Monitor" ]; then
echo "Start mode monitor on [$interface]"
airmon-ng check kill
airmon-ng start $interface
else
echo "Mode Monitor enable"
fi

to check mode monitor

Feature Request: GPS Puck

Please add support for external GPS devices to track location so it can be tracked without requiring internet access. That would be a huge benefit to this project. Requiring internet access for this just provides dangerous metadata about what your doing.

How do i select the wireless interface?

filter airodump

hello

try crack handshack on OPN wifi is usless.
you can add filter

timeout --foreground 3 airodump-ng "$interface" -t wpa -w /tmp/hc_out --output-format csv &> /dev/null

Missing dog. Help needed.

The official description is:

"[...] so that you can capture handshakes while walking your dog."

I have the tool, now I want a dog.

Please be professional and remove those kinds of comments.

cap2hccapx deprecated

hello

cap2hccapx is deprecated and not present in hxtools
use hcxpcaptool instead

The following packages are missing. Please ensure that you have installed them properly before starting hashcatch

I am running Kali Linux 2021.4a freshly installed :

uname -a

Linux kali 5.14.0-kali4-amd64 #1 SMP Debian 5.14.16-1kali1 (2021-11-05) x86_64 GNU/Linux

I installed all prerequisites :

sudo apt install aircrack-ng hashcat-utils hcxtools jq

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
aircrack-ng is already the newest version (1:1.6+git20210130.91820bc-2).
hashcat-utils is already the newest version (1.9-0kali2).
hcxtools is already the newest version (6.2.5-2).
jq is already the newest version (1.6-2.1).
0 upgraded, 0 newly installed, 0 to remove and 745 not upgraded.

When I try to install hashcatch, I have an error :

udo ./hashcatch --setup

 __   __  _______  _______  __   __  _______  _______  _______  _______  __   __                                    
|  | |  ||   _   ||       ||  | |  ||       ||   _   ||       ||       ||  | |  |                                   
|  |_|  ||  |_|  ||  _____||  |_|  ||       ||  |_|  ||_     _||       ||  |_|  |                                   
|       ||       || |_____ |       ||       ||       |  |   |  |       ||       |                                   
|       ||       ||_____  ||       ||      _||       |  |   |  |      _||       |                                   
|   _   ||   _   | _____| ||   _   ||     |_ |   _   |  |   |  |     |_ |   _   |                                   
|__| |__||__| |__||_______||__| |__||_______||__| |__|  |___|  |_______||__| |__|                                   
                                                                                                                    
[*] Starting hashcatch setup                                                                                        
[*] Enter your wireless interface: wlan0 
[*] Trying to set the given interface to monitor mode
[+] The adapter is working in monitor mode!
[!] The following packages are missing. Please ensure that you have installed them properly before starting hashcatch                                                                                                                   
        hashcat-utils
[*] Done

How can I fix the problem ?

Link on readme is to aircrack not hashcatch

Link on readme is to aircrack not hashcatch

package architecture (any) does not match system (amd64)
Not install-able

Cannot install hashcatch using .deb file on rpi4

After trying to install using .deb file i get an error saying:
dpkg: error processing archive /home/pi/hashcatchi/hashcatch_1.2_any.deb (--unpack): package architecture (any) does not match system (armhf)
Im trying to use the .deb file because even if i make hashcat-utils nothing shows up in /bin or hashcat-utils/bin

u need a wireless adapter that support packet injection , or any wlan0 adapter?thx

Command not found

after fixing the problem with hashcat-utils not found,
[] Starting hashcatch setup
ls: cannot access '/usr/share/hashcatch/handshakes/': No such file or directory
[] Enter your wireless interface: wlan0
[] Trying to set the given interface to monitor mode
[+] The adapter is working in monitor mode!
./hashcatch: line 88: /etc/hashcatch/hashcatch.conf: No such file or directory
[] All necessary packages are found installed
[*] Done

It looks succesful but when trying to start hashcatch, it says command not found, like its not installed.

can't get it to work...

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Status: Scanning for wifi networks

Last scan: Pwned all nearby WiFi networks
./hashcatch.sh: Zeile 156: /tmp/hc_out-01.csv: Datei oder Verzeichnis nicht gefunden
rm: das Entfernen von '/tmp/hc_out*' ist nicht möglich: Datei oder Verzeichnis nicht gefunden

Error installation

Hello,

When I run sudo ./hashcatch --setup I have this error:

[+] The adapter is working in monitor mode!
./hashcatch: line 88: /etc/hashcatch/hashcatch.conf: The file or directory does not exist
[!] The following packages are missing. Please ensure that you have installed them properly before starting hashcatch
        hashcat-utils

But I have installed this package.

Can anyone help me.

A greeting and thanks

Hashcatch on Raspberry Pi - cannot install hashcat-utils

I'm currently facing the issue that my Raspberry Pi won't setup because it tells me to install hashcat-utils. But how to install that the proper way for hashcatch and Raspberry Pi?

[!] The following packages are missing. Please ensure that you have installed them properly before starting hashcatch - hashcat-utils

I tried to download hashcat from GitHub and compiled it manually (sudo make && sudo make install). That install hashcat for me. But it seems like Hashcatch does not like this way?

Any help please?

Hcxtools are missing

[!] The following packages are missing. Please ensure that you have installed them properly before starting hashcatch
hcxtools

But i have it installed

Packages are missing - hashcat-utils

On my Kali for Raspberry Pi Zero W I got:
[!] The following packages are missing. Please ensure that you have installed them properly before starting hashcatch
hashcat-utils

Where are no hashcat-utils in Kali repository, so I downloaded and compiled hashcat-utils and run hashcatch again - same message.
How to show hashcatch path to my folder /root/hashcat-utils/bin/ ?

Can't install hashcat-utils on raspberry pi

I'm running kali on a raspberry pi zero w with nexmon patch. When I run the setup of hashcatch. It says hashcat-utils dependency is missing. But I can't find hashcat-utils in the repository. Any help with the issue please?

[-] Essential file(s) missing. Run with --setup and try again!

I'm on kali. What is the problem?

fixed error **command not found**

simply run
sudo bash hashcatch

An real important feature

@staz0t
If the network has wps enabled .. It would give you a lot of info.like router model number and serial number and if it's pbc or pin .

And an idea for another project is a user agent collector
it's just a mix of karma attack and a web server to catch the user agent and the ap that it came from with both bssids and maybe deauth would be useful in that part
just like this
Img
I think it can be done without a webserver as the APS send the user agent in the background... And of course store that info in a db

test of pmkid

hello

It coul'd be cool to have pmkid crack support

https://online-it.nu/how-to-attack-wpa-wpa2-pmkid-kali-linux-2018-4/

hashcat-utils

Hashcatch will not recognize hashcat-utils. Please help with any suggestions.