ZerBea
commented
2 years ago hcxpcapngtool found neither PMKIDs nor EAPOL 4way handshakes in the dump file.
There is nothing to convert and hcxpcapngtool told you this:
Information: no hashes written to hash files
You command line to attack the target is correct:
sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=15
But you have to run it as long as you get either a PMKID or an EAPOL 4way handshake.
Depending on your hardware (interface and antenna) and your environment (distance to target), one and a half minute hcxdumptool runtime may not be enough.
Try this example, taken from https://wiki.wireshark.org/SampleCaptures
$ wget https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/wpa-Induction.pcap
$ hcxpcapngtool -o test.hc22000 -E essid wpa-Induction.pcap
hcxpcapngtool 6.2.7-19-g48b6193 reading from wpa-Induction.pcap...
summary capture file
--------------------
file name................................: wpa-Induction.pcap
version (pcap/cap).......................: 2.4 (very basic format without any additional information)
timestamp minimum (GMT)..................: 04.01.2007 07:14:45
timestamp maximum (GMT)..................: 04.01.2007 07:15:26
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianess (capture system)...............: little endian
packets inside...........................: 1093
frames with correct FCS..................: 1080
packets received on 2.4 GHz..............: 1093
WIRELESS DISTRIBUTION SYSTEM.............: 1
ESSID (total unique).....................: 2
BEACON (total)...........................: 398
BEACON on 2.4 GHz channel (from IE_TAG)..: 1
PROBEREQUEST.............................: 12
PROBEREQUEST (directed)..................: 1
PROBERESPONSE (total)....................: 26
DISASSOCIATION (total)...................: 1
AUTHENTICATION (total)...................: 2
AUTHENTICATION (OPEN SYSTEM).............: 2
ASSOCIATIONREQUEST (total)...............: 1
ASSOCIATIONREQUEST (PSK).................: 1
RESERVED MANAGEMENT frame................: 4
WPA encrypted............................: 280
EAPOL messages (total)...................: 4
EAPOL RSN messages.......................: 4
EAPOLTIME gap (measured maximum usec)....: 4998
EAPOL ANONCE error corrections (NC)......: working
REPLAYCOUNT gap (recommended NC).........: 8
EAPOL M1 messages (total)................: 1
EAPOL M2 messages (total)................: 1
EAPOL M3 messages (total)................: 1
EAPOL M4 messages (total)................: 1
EAPOL pairs (total)......................: 2
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file...: 1 (RC checked)
EAPOL M32E2 (authorized).................: 1
PMKID (total)............................: 1
PMKID (from zeroed PMK)..................: 1
frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
2412: 1093
Information: limited dump file format detected!
This file format is a very basic format to save captured network data.
It is recommended to use PCAP Next Generation dump file format (or pcapng for short) instead.
The PCAP Next Generation dump file format is an attempt to overcome the limitations
of the currently widely used (but limited) libpcap (cap, pcap) format.
https://www.wireshark.org/docs/wsug_html_chunked/AppFiles.html#ChAppFilesCaptureFilesSection
https://github.com/pcapng/pcapng
Information: missing frames!
This dump file does not contain enough EAPOL M1 frames.
It always happens if the capture file was cleaned or
it could happen if filter options are used during capturing.
That makes it impossible to calculate nonce-error-correction values.
session summary
---------------
processed cap files...................: 1
$ cat essid
Coherer
linksys
$ hashcat -m 22000 test.hc22000 -a 3 Induction
hashcat (v6.2.5-482-g6886a7069) starting
...
a462a7029ad5ba30b6af0df391988e45:000c4182b255:000d9382363a:Coherer:Induction
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: test.hc22000
Time.Started.....: Sat Jun 25 07:04:45 2022 (0 secs)
Time.Estimated...: Sat Jun 25 07:04:45 2022 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: Induction [9]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 41 H/s (0.63ms) @ Accel:64 Loops:256 Thr:32 Vec:1
Recovered.Total..: 1/1 (100.00%) Digests
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: Induction -> Induction
Hardware.Mon.#1..: Temp: 46c Util: 57% Core:1890MHz Mem:4001MHz Bus:8
Started: Sat Jun 25 07:04:43 2022
Stopped: Sat Jun 25 07:04:46 2022Take a look at hcxpcapngtool output, especially this part
EAPOL M1 messages (total)................: 1
EAPOL M2 messages (total)................: 1
EAPOL M3 messages (total)................: 1
EAPOL M4 messages (total)................: 1
EAPOL pairs (total)......................: 2
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file...: 1 (RC checked)
EAPOL M32E2 (authorized).................: 1The dumpfile contain EAPOL data, hcxpcapngtool found and converted them.
Closed, because it is not an hcxpcapngtool issue, but you can still ask your questions here
5vl
Yes, it is true that I'm running Kali in a VM. 
carkod
So when I run
sudo hcxpcapngtool -o hash.hc22000 -E essidlist dumpfile.pcapngit gives me the following output:I don't know what I did wrong, and to get the file i did the command
sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=15I followed this tutorial: https://www.youtube.com/watch?v=Usw0IlGbkC4
Please help me fix this!