Skip to main content

​
Overview

hcxtools is a set of utilities for converting WPA capture files into formats compatible with modern hashcat. The suite replaces the deprecated mode 2500 workflow with the current mode 22000 format.

​
Install

sudo apt install hcxtools

​
Tools

ToolPurpose
hcxpcapngtoolConvert pcap/pcapng to hashcat 22000 format
hcxhash2capConvert hccapx (mode 2500) to pcap
hcxdumptoolActive capture with PMKID and EAPOL (separate package — apt install hcxdumptool, not part of hcxtools)

​
hcxpcapngtool

Converts a capture file directly to hashcat mode 22000: 
hcxpcapngtool [options] <input.cap> -o <output.22000>

hcxpcapngtool capture.cap -o hash.22000
Crack the output: 
hashcat -a 0 -m 22000 hash.22000 ~/rockyou.txt --force

​
hcxhash2cap

Converts legacy hccapx (mode 2500) to pcap for re-processing: 
hcxhash2cap --hccapx=<file.hccapx> -c <output.pcap>

hcxhash2cap --hccapx=hostapd.hccapx -c aux.pcap
hcxpcapngtool aux.pcap -o hash.22000

​
hcxdumptool

Active capture tool that requests PMKIDs from APs and captures EAPOL handshakes: 
hcxdumptool [options] -o <output.pcapng> -i <interface>
FlagDescription
-i <iface>Monitor mode interface
-o <file>Output pcapng file
--enable_status=3Show live status
--filterlist_ap=<file> --filtermode=2Only target listed BSSIDs (--filtermode is mandatory; =2 = target list, =1 = ignore list). Removed in 6.3.0+, which uses --bpf=
sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=3
hcxpcapngtool capture.pcapng -o hash.22000
hashcat -a 0 -m 22000 hash.22000 ~/rockyou.txt