WPA 802.11r Fast BSS Transition (FT-PSK)

[ZerBea]

As of today, conversion of WPA 802.11r Fast BSS Transition (FT-PSK) has been added to hcxpcapngtool.
Now hcxpcapngtool support conversion of FT-PSK PMKID and FT-PSK ESPOL to hashcat's new format -m 37100..
As long as the pull request wasn't merged, it is up to you to apply it to your hashcat source

This information ist stored in "WPA Key Data" of an EAPOL M2 frame:

WPA Key Data […]: 30260100000fac040100000fac040100000fac04000001003378f874c1930b599405d3de4b6e05cc3603010201376c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
     Tag: RSN Information
     Tag: Mobility Domain
     Tag: Fast BSS Transition

Due to hashcat and JtR limits, oversized MESSAGES are not(!) converted.
This limits are old relicts of the binary hccap and hccapx format.

Limits:

• EAPOL AUTH_LEN_MAX = 256 bytes (hashcat and JtR)
• R0KHID_LEN = 12 bytes (hostapd)
• R1KHID_LEN_MAX = 48 bytes (hostapd)

If the limits exceed, hcxpcapngtool shows a warning and does not convert them.

Example:

Download example dump file:
wpa2-ft-psk_12345678.pcapng.zip

unzip file

$ unzip wpa2-ft-psk_12345678.pcapng.zip
Archive:  wpa2-ft-psk_12345678.pcapng.zip
  inflating: wpa2-ft-psk_12345678.pcapng  

convert it to a hc37100 hash file:

$ hcxpcapngtool -f ftpsk.hc37100 wpa2-ft-psk_12345678.pcapng
hcxpcapngtool 7.1.2-39-g2bd2d84 reading from wpa2-ft-psk_12345678.pcapng...

summary capture file
--------------------
file name................................: wpa2-ft-psk_12345678.pcapng
version (pcapng).........................: 1.0
operating system.........................: Linux 5.4.0-58-generic
application..............................: Dumpcap (Wireshark) 3.3.2 (v3.3.2rc0-161-gd0270415a9d1)
interface name...........................: phy8.mon
interface vendor.........................: 000000
openSSL version..........................: 1.0
weak candidate...........................: N/A
MAC ACCESS POINT.........................: 000000000000 (incremented on every new client)
MAC CLIENT...............................: 000000000000
REPLAYCOUNT..............................: 0
ANONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000
SNONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000
timestamp minimum (timestamp)............: 09.01.2021 21:00:56 (1610226056)
timestamp maximum (timestamp)............: 09.01.2021 21:01:02 (1610226062)
duration (rounded).......................: 6s
used capture interfaces..................: 1
link layer header type...................: DLT_IEEE802_11_RADIO (127)
endianness (capture system)..............: little endian
packets inside...........................: 19
packets received on 2.4 GHz..............: 19
ESSID (total unique).....................: 1
BEACON (total)...........................: 5
BEACON on 2.4 GHz channel (from IE_TAG)..: 1 
AUTHENTICATION (total)...................: 2
AUTHENTICATION (OPEN SYSTEM).............: 2
ASSOCIATIONREQUEST (total)...............: 1
ASSOCIATIONREQUEST (FT using PSK)........: 1
WPA encrypted............................: 6
EAPOL messages (total)...................: 4
EAPOL RSN messages.......................: 4
EAPOLTIME gap (measured maximum msec)....: 7
EAPOL ANONCE error corrections (NC)......: not detected
EAPOL M1 messages (total)................: 1
EAPOL M2 messages (total)................: 1
EAPOL M2 messages (FT using PSK).........: 1 (not supported by hashcat/JtR)
EAPOL M3 messages (total)................: 1
EAPOL M3 messages (oversized)............: 1 (not supported by hashcat/JtR)
EAPOL M4 messages (total)................: 1
EAPOL M4 messages (zeroed NONCE).........: 1
EAPOL pairs (total)......................: 1
EAPOL pairs (best).......................: 1
EAPOL pairs written to 37100 hash file...: 1 (RC checked)
EAPOL M12E2 (challenge - ANONCE from M1).: 1
RSN PMKID (total)........................: 1
RSN PMKID FT-PSK ........................: 1
RSN PMKID (best).........................: 1
RSN PMKID written to 37100 hash file.....: 1

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2412: 19	

Information: missing frames!
This dump file does not contain undirected proberequest frames.
An undirected proberequest may contain information about the PSK. It always happens if the capture file was cleaned or it could happen if filter options are used during capturing.
That makes it hard to recover the PSK.
https://github.com/ZerBea/hcxdumptool/discussions/526

Information: missing frames!
This dump file does not contain enough EAPOL M1 frames.
It always happens if the capture file was cleaned or it could happen if filter options are used during capturing.
That makes it impossible to calculate nonce-error-correction values.
https://hashcat.net/forum/thread-6361.html
Duration was a way too short to capture enough additional information.

session summary
---------------
processed pcapng files................: 1

The new hash file looks like this:

$ cat ftpsk.hc37100
WPA*03*3378f874c1930b599405d3de4b6e05cc*020000000000*020000000100*746573742d66742d70736b***20*0102*77697265736861726b2d66742d70736b*020000000000
WPA*04*dd411684bd6e123bce3a606b2be06de2*020000000000*020000000100*746573742d66742d70736b*eb131d608a197829340c645c3bf30df2c0c8e818e9e31c560af630664a21a009*010300fa02010b00000000000000000001b44919486bacb36befb4ab90c14e639bc5027cca16d62a1525c2424e6ac7d2fe000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009b30260100000fac040100000fac040100000fac04000001003378f874c1930b599405d3de4b6e05cc3603010201376c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000106020000000000031077697265736861726b2d66742d70736b*80*0102*77697265736861726b2d66742d70736b*020000000000

WPA*03 = PMKID
WPA*04 = EAPOL MESSAGE PAIR

get latest word list from wpa-sec:

$ wget https://wpa-sec.stanev.org/dict/cracked.txt.gz

run hashcat:

$ hashcat -m 37100 ftpsk.hc37100 cracked.txt.gz
hashcat (v7.1.2-382-g2d71af371) starting
...
3378f874c1930b599405d3de4b6e05cc:020000000000:020000000100:test-ft-psk:12345678
dd411684bd6e123bce3a606b2be06de2:020000000000:020000000100:test-ft-psk:12345678
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 37100 (FT-PSK (802.11r Fast BSS Transition))
Hash.Target......: ftpsk.hc37100
Time.Started.....: Fri Mar 27 08:19:05 2026 (0 secs)
Time.Estimated...: Fri Mar 27 08:19:05 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 8-63 bytes)
Guess.Base.......: File (cracked.txt.gz)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  1452.6 kH/s (8.87ms) @ Accel:4 Loops:512 Thr:384 Vec:1
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new)
Progress.........: 116738/758630 (15.39%)
Rejected.........: 2/116738 (0.00%)
Restore.Point....: 0/758630 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:1-3
Candidate.Engine.: Device Generator
Candidates.#01...: 12345678 -> ameer123
Hardware.Mon.#01.: Temp: 40c Fan:  0% Util: 16% Core:2835MHz Mem:10801MHz Bus:16

Started: Fri Mar 27 08:18:52 2026
Stopped: Fri Mar 27 08:19:07 2026

PSK has been successful recovered from the PMKID and the EAPOL MESSAGE PAIR.

[ayusuf8915-creator]

Sana görsel Atacam düzenliye bilirmisin

[kimocoder]

Noted. Thanks!