---

hcxdumptool is a WiFi handshake capture tool designed to capture WPA/WPA2 handshakes and PMKID hashes from wireless networks. It works with monitor mode interfaces and can extract handshakes even from APs without active clients.

---

Basic Usage

• hcxdumptool -i <interface> -o <output> - Basic capture

• hcxdumptool -i wlan0mon -o capture.pcapng - Capture to file

• hcxdumptool -i <interface> --enable_status=1 -o <output> - With status output

---

Interface Options

• -i <interface> - Monitor mode interface (required)

• --filterlist_ap=<file> - Filter list of APs (maclist)

• --filterlist_client=<file> - Filter list of clients

• --filterlist_mac=<file> - Combined filter list

• --filtermode=1 - Filter mode (0=disabled, 1=AP, 2=client, 3=both)

---

Target Selection

• -c <channel> - Lock to specific channel

• --do_rcascan - Perform channel scan

• --rcascanlist=<channels> - Channels to scan (e.g., "1,6,11")

• --bpf=<filter> - Berkeley Packet Filter

---

Capture Options

• --enable_status=1 - Enable status output

• --enable_status=2 - Verbose status output

• --enable_status=3 - Very verbose output

• --disable_client_attacks - Disable client attacks

• --disable_ap_attacks - Disable AP attacks

• --active_beacon - Send active beacons

• --stop_ap_attacks=<num> - Stop after N AP attacks

• --stop_client_attacks=<num> - Stop after N client attacks

---

Output Options

• -o <file> - Output file (.pcapng format)

• -w <file> - Write PMKID to file

• --write_status=<file> - Write status to file

• -k <file> - Read PMKID from file

---

PMKID Capture

• --enable_status=1 - Enable PMKID capture

• -w <file> - Save PMKID hashes

• PMKID is captured in first EAPOL message

• No client required for PMKID capture

---

Handshake Capture

• Captures 4-way handshake automatically

• Works when clients connect/disconnect

• Can force deauthentication for handshake

---

Common Examples

Basic Capture

sudo hcxdumptool -i wlan0mon -o capture.pcapng

Capture with Status

sudo hcxdumptool -i wlan0mon --enable_status=1 -o capture.pcapng

Capture Specific Channel

sudo hcxdumptool -i wlan0mon -c 6 -o capture.pcapng

Filter Specific APs

sudo hcxdumptool -i wlan0mon --filterlist_ap=ap_list.txt --filtermode=1 -o capture.pcapng

Capture PMKID Only

sudo hcxdumptool -i wlan0mon -w pmkid.txt -o capture.pcapng

Scan Specific Channels

sudo hcxdumptool -i wlan0mon --do_rcascan --rcascanlist="1,6,11" -o capture.pcapng

Verbose Output

sudo hcxdumptool -i wlan0mon --enable_status=3 -o capture.pcapng

Disable Client Attacks

sudo hcxdumptool -i wlan0mon --disable_client_attacks -o capture.pcapng

---

Workflow

1. Put interface in monitor mode: sudo airmon-ng start wlan0
2. Start capture: sudo hcxdumptool -i wlan0mon -o capture.pcapng
3. Let it run to capture handshakes/PMKIDs
4. Convert with hcxpcapngtool for hashcat
5. Crack with hashcat

---

Tips

• Interface must be in monitor mode (use airmon-ng or iw)

• Requires root/sudo privileges

• PMKID capture doesn't require active clients

• Handshake capture works best when clients connect/disconnect

• Use --enable_status for real-time information

• Filter lists help focus on specific targets

• Use -c to lock to specific channel for better results

• Output is in pcapng format (compatible with Wireshark)

• Always test on authorized networks only

• Convert pcapng to hashcat format with hcxpcapngtool

---