Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Can anyone help me to decrypt wpa2 handshake : hacking | Torhoo darknet markets

I've already captured the handshake of a wpa2 protected wifi and converted it .hc22000 file and here it is:
WPA*02*278457bf686937057eb0e6ac17e67eb8*c8eaf8284a19*1e3ebb462329*49646f6f6d2034475f3834413139*94c965eb10e2ac6c63d5b041dca125276ae7432dd0547bc08932cde6c619bb39*0103007502010a0000000000000000000007da28058428c667dfc31b7644596f18fc27ee818ec3c59aecec2bdbb7e87181000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*c2

I'm new in this domain tbh so if anyone could help (already tried rouckyou.txt)
What i know is that you need to use another router instead of yours

/u/moonship

3 points

3 weeks ago

I would recommend not sharing WPA2 handshake on public forum if your goal is anonymity.

In theory, law enforcement could break handshake, recover WiFi password and collaborate with internet providers to identify customers with specific WiFi password.

Exist sites like WIGGLE that help locate WiFi using unique SSID. However, extracting WiFi SSID or BSSID from hash seems problematic.

/u/l4wl13t 📢 🍼

1 points

3 weeks ago

I got the handshake and trying to to crack the password, anything can help?

/u/moonship

1 points

3 weeks ago

note: you may have to use a command line tool to convert it into the correct format. do some google searches for that.
-
1. run

hashcat -h | grep -i WPA

and make note of the "mode number" for WPA2 - 2. put the hash in a file

echo '<hash>' > hash.txt

- 3. Get a wordlist for WPA (google) - 4. run

hashcat -m <mode number> ./hash.txt <path-to-wordlist>

-
5. Let it run for a while. Depending on your hardware and length of wordlist it might take a while. Pickup a GTX 970 for and let it run overnight.

/u/MeltingWoodwork

1 points

3 weeks ago*

your first advice is good moonshine. but your advice on converting it to the correct format is off. he already has it in the correct format i believe.

edit01: and he was able to run rockyou on it already

/u/DaSnake

1 points

3 weeks ago*

I'd first try to crack it online.
There are tools both paid and free that support pcap and pcapng capture files, you can use their resources.

/u/l4wl13t 📢 🍼

1 points

3 weeks ago

Currently it's not a .pcap file i converted it to .hc22000

/u/MeltingWoodwork

1 points

3 weeks ago*

i echo moonship

by posting that hash on the darknet you give away some info you may not want to. you are fine, don't worry, i will try to explain why for learning purposes. i may get my terminology wrong as it has been awhile since i did any of this stuff. so i welcome any corrections or additions anyone has.

by the way - good job getting the pcap and converting it to 22000 format - that is half the battle. good job!
look into "PMKID" now and see about getting some WPA*01 instead of your WPA*02 from the start of your 22000 line. note: the WPA*02 at the beginning of your hash does not mean wpa2.

here is the explanation of the 22000 hash line you provided in your original post:
WPA*02*MIC*MAC_AP*MAC_CLIENT*ESSID*NONCE_AP*EAPOL_CLIENT*MESSAGEPAIR

the MAC_AP of the router or phone hotspot you got this handshake from is:
c8:ea:f8:28:4a:19
so it may be some form of zte phone or zte portable hotspot, not sure if zte makes routers

the MAC_CLIENT of the device you used to get it is:
1e:3e:bb:46:23:29
assuming you didn't spoof your mac before grabbing it.
edit01: actually i may be wrong here, that may be the client that was handshaking. if this was a WPA*01 hash then then the client would be you

the ESSID (most likely the name of the access point in this case is)
49646f6f6d2034475f3834413139
or if you convert from hex
Idoom 4G_84A19

Idoom may be the name of the phone or user - but 4G_84A19 is probably some form of default naming convention someone could dig deeper into and possible get the specific device. the 4G makes me think this is a phone's hotspot.

the biggest issue is the one moonshine stated already. anyone can go on wigle(dot)net and search c8:ea:f8:28:4a:19 on the BSSID field and possible get a geolocation hit. if they do get a hit then one could assume it is your next door neighbor and you live one door over. or at the very least that you were around that spot.

so if you do not care about that information being out on the darkweb then cool. but if you weren't aware of that information being in that hash - be careful.

if you want to continue - try getting better wordlists from sites like weakpass(dot)com. WPA2 word lists look for the files with "_w" at the end and already be filtered for 8 to 30 characters with the correct characters. there is also rules and i think masks that can be applied to wordlists.