So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the right term for a .hash file). I've learned how to use crunch - but it is obviously insanely slow. I read somewhere that you can scan hash tables at about 18000 keys/sec on a fast computer (mine is a MacBook Pro - maybe someone could help me figure out how well mine will fair). I am using aircrack-ng to accomplish the handshake - and I've been told I can use JTR, cowPATTY, Reaver, oclHashcat, etc., but I can't figure out how to get aircrack-ng to work with one of these programs, so that I can parse the .hash files. Right now, from what I have read - I am approaching it from the angle that I need to use a program like oclHashcat. However, due to my computer specs (Intel 3rd gen onboard graphics) - oclHashcat won't work. I am now under the impression that I need to convert the .hash files to a .cap file. I also was able to get one of the above programs to work with aircrack-ng on a single .hash file - but I realized they all need to be the same name as the ESSID you are trying to crack. I tried simply merging them with the mv command - but I knew in my heart of hearts that wouldn't work! I am using Kali Linux - any help would be appreciated (stergling n00b).
1 Answer
Short answer: this is the link you're probably looking for (-s specifies SSID).
Longer answer: Precomputed 'hash' files are used to accelerate password bruteforce when cracking WPA. They do this by eliminating the need to perform costly transformation of a password into an encryption key; instead somebody already computed such keys for common SSIDs and passwords and saved them into this hash file.
Note that hash table is computed for a limited number of passwords (~170K for 7 GB table in this case) and limited set of SSID (~1000 for 7 GB table).
This means two things:
- They are only useful to you if your SSID is in that set;
- They are only useful to check if password to your handshake is one of the used while generating the table.
If you need to go beyond that (i.e. SSID isn't n the set or you ant to test some specific passwords) you're need to revert to bruteforce/dictionary cracking. Both aircrack-ng and coWPAtty can do this (although obviously much slower than just going through precomputed hash table).
oclHascat isn't working on your because it needs a GPU to work (a discrete one).
Precomputed hash file is orthogonal to .cap – don't try to convert them into each other, this makes absolutely no sense.
