Until now I have only tested WPA hashes, and they have been extracted from a airodump-ng's capture file using tshark or aircrack-ng (-J option). I wanna go one step beyond, and in an effort to undestand and learning a bit of the inners of hash file extraction, I wanna strip (if possible) a real hash from a .cap WireShark's capture file. I have captured those types of authentication:

  • VNC (RealVNC).
  • SSH2 (OpenSSH).
  • SMB (connection to SAMBA server).

so I would like to know the way of obtaining a single hash from any of those .cap files. Is there any automation for this task? Or can I copy&paste directly any data from some of the captured package/s?

I have tested EtterCap, TShark and Cain&Abel with no results. None of them seems to give a valid hash string.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.