So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the right term for a .hash file). I've learned how to use crunch - but it is obviously insanely slow. I read somewhere that you can scan hash tables at about 18000 keys/sec on a fast computer (mine is a MacBook Pro - maybe someone could help me figure out how well mine will fair). I am using aircrack-ng to accomplish the handshake - and I've been told I can use JTR, cowPATTY, Reaver, oclHashcat, etc., but I can't figure out how to get aircrack-ng to work with one of these programs, so that I can parse the .hash files. Right now, from what I have read - I am approaching it from the angle that I need to use a program like oclHashcat. However, due to my computer specs (Intel 3rd gen onboard graphics) - oclHashcat won't work. I am now under the impression that I need to convert the .hash files to a .cap file. I also was able to get one of the above programs to work with aircrack-ng on a single .hash file - but I realized they all need to be the same name as the ESSID you are trying to crack. I tried simply merging them with the mv command - but I knew in my heart of hearts that wouldn't work! I am using Kali Linux - any help would be appreciated (stergling n00b).

1 Answer 1


Short answer: this is the link you're probably looking for (-s specifies SSID).

Longer answer: Precomputed 'hash' files are used to accelerate password bruteforce when cracking WPA. They do this by eliminating the need to perform costly transformation of a password into an encryption key; instead somebody already computed such keys for common SSIDs and passwords and saved them into this hash file.

Note that hash table is computed for a limited number of passwords (~170K for 7 GB table in this case) and limited set of SSID (~1000 for 7 GB table).

This means two things:

  1. They are only useful to you if your SSID is in that set;
  2. They are only useful to check if password to your handshake is one of the used while generating the table.

If you need to go beyond that (i.e. SSID isn't n the set or you ant to test some specific passwords) you're need to revert to bruteforce/dictionary cracking. Both aircrack-ng and coWPAtty can do this (although obviously much slower than just going through precomputed hash table).

oclHascat isn't working on your because it needs a GPU to work (a discrete one).

Precomputed hash file is orthogonal to .cap – don't try to convert them into each other, this makes absolutely no sense.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.