unfinished handshake

[TheWarGlory]

the bug:**
handshake only have 2 meassages out of 4

Steps To Reproduce:
wif>wifi atcks>tageted>handshake hijake> successfull

• Device used:
  ESP32-S3 N16R8
  Expected behavior:
  full handshake packets

[bmorcelli]

#2663

It now focuses in M1+M2.. doesn't need all 4 to be cracked

[TheWarGlory]

#2663

It now focuses in M1+M2.. doesn't need all 4 to be cracked

ty for replying, well i thought so as well and used hashcat to crack the hash and because its my router , i know the password so i try to crack it using my password, but it turn "exhausted"

[bmorcelli]

I will test it here too

Didn't test it after this change

[TheWarGlory]

I will test it here too

Didn't test it after this change

good news , i got now all 4messages, but i lowered the firmware vestion to the latest , i was using beta because it was smoother

[bmorcelli]

1.15 grabs the 4 messages.. Beta is getting 2..

We need to test and decide on rather keeping only 2 or getting back to 4..

@Mysteriza @pr3y

[Huzzla101]

The newest way is to get the m1-m4 4handshakes totally so hashcat can then gather the packages and calibrate them into the newest version .hc2200 and in that way hashcat can work 10000% times faster thru the algorithms as if it used to say process will take about 3 days then with hc22000 format it only takes like max 5hours to find password , BUT the old "normal" way was to gather the main 2 HS and that is enough for any pen testing decrypter tool to decipher out the HS directly from the Pcap file.... But are we sure that those 2 handshakes are the same info as in M1 and M2 ? No i think the main structure is different , as the logic is older and thereof it takes more time but im not sure if you use the pcap 2way hs technique here or have you taken out normal m1-m4 that are used for making hc22000 format as that will not work.. So maybe we need to integrate booth ways , keep the 4 HS for the HC22000 files and also use the old 2hs way with pcap files directly .. If possible we should go for booth , the sniffer seems to collect the pcap hs where 2 is needed only but im not sure if it follow the hc22000 logic but since its a pcap package sniffer to it should be able to choose what package it will look for.. the 4way or 2way hs methodology....Lets try get booth of the techniques? Some of us have some heavy pc´s and graphic cards that can handle the old way to ... =)

…

On Tue, Jul 21, 2026 at 5:37 PM Pirata ***@***.***> wrote: *bmorcelli* left a comment (BruceDevices/firmware#2677) <#2677 (comment)> 1.15 grabs the 4 messages.. Beta is getting 2.. We need to test and decide on rather keeping only 2 or getting back to 4.. @Mysteriza <https://github.com/Mysteriza> @pr3y <https://github.com/pr3y> — Reply to this email directly, view it on GitHub <#2677?email_source=notifications&email_token=BLDL6BQQWLF32CTXEX7U5GL5F6E4TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBTGU4TSOBTGMY2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-5035998331>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BLDL6BQ4DQI2U4NVKLOIEST5F6E4TAVCNFSNUABFKJSXA33TNF2G64TZHM3TSNJRGY3DSNRRHNEXG43VMU5TIOJUGAZDGMJZGMZKC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BLDL6BR7MJ5G4DC5AHDKC6D5F6E4TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBTGU4TSOBTGMY2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/BLDL6BSDBJDEX6BGWLXIS735F6E4TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBTGU4TSOBTGMY2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- Kind Regards C.R May Prosperity allways be with us!!

[TheWarGlory]

1.15 grabs the 4 messages.. Beta is getting 2..

We need to test and decide on rather keeping only 2 or getting back to 4..

@Mysteriza @pr3y

AND the death frams dont go automatiqually in 1.15 and they dont do disconnect hosts , while beta have great deauth , it doesnt capt all paquets 2/4 .

[TheWarGlory]

The newest way is to get the m1-m4 4handshakes totally so hashcat can then
gather the packages and calibrate them into the newest version .hc2200 and
in that way hashcat can work 10000% times faster thru the algorithms as if
it used to say process will take about 3 days then with hc22000 format it
only takes like max 5hours to find password , BUT the old "normal" way was
to gather the main 2 HS and that is enough for any pen testing decrypter
tool to decipher out the HS directly from the Pcap file.... But are we sure
that those 2 handshakes are the same info as in M1 and M2 ? No i think the
main structure is different , as the logic is older and thereof it takes
more time but im not sure if you use the pcap 2way hs technique here or
have you taken out normal m1-m4 that are used for making hc22000 format as
that will not work.. So maybe we need to integrate booth ways , keep the 4
HS for the HC22000 files and also use the old 2hs way with pcap files
directly .. If possible we should go for booth , the sniffer seems to
collect the pcap hs where 2 is needed only but im not sure if it follow the
hc22000 logic but since its a pcap package sniffer to it should be able to
choose what package it will look for.. the 4way or 2way hs
methodology....Lets try get booth of the techniques? Some of us have some
heavy pc´s and graphic cards that can handle the old way to ... =)
…

for me, when i gave it only 2/4 messages, it didnt crack the hash althought i gave it the correct password, but now that i got my hand on the 4 messages, hashcat cracked the hash successfully

[TheWarGlory]

conclusion: when it comes to both deauth and handshake capture, 1.14 is the best,

[Mysteriza]

We need to test and decide on rather keeping only 2 or getting back to 4..

Given the situation, I think it's better to go back to capturing all 4 handshake messages. While M1 and M2 are often enough and can usually be captured faster, collecting all 4 messages gives us a more reliable handshake. Once we have a valid handshake, it can be converted to the hc22000 format and used with Hashcat's optimized cracking mode.

So the trade-off is simple: capture fewer messages for speed, or capture all 4 for better reliability.

In conclusion, I think we should just go back to capturing all 4 messages (Although I actually still prefer to stick with just M1 and M2, because the capture handshake process will be faster and won’t put a strain on the ESP32).

[TheWarGlory]

We need to test and decide on rather keeping only 2 or getting back to 4..

Given the situation, I think it's better to go back to capturing all 4 handshake messages. While M1 and M2 are often enough and can usually be captured faster, collecting all 4 messages gives us a more reliable handshake. Once we have a valid handshake, it can be converted to the hc22000 format and used with Hashcat's optimized cracking mode.

So the trade-off is simple: capture fewer messages for speed, or capture all 4 for better reliability.

In conclusion, I think we should just go back to capturing all 4 messages.

i don't get it, if only 2 messages are enought, then why hash cat couldnt crask the hash althought i gave it the password , but when i gave it full 4messages it cracked it easly

[Mysteriza]

i don't get it, if only 2 messages are enought, then why hash cat couldnt crask the hash althought i gave it the password , but when i gave it full 4messages it cracked it easly

That’s something even I don’t understand. As far as I know and based on my testing, M1 and M2 alone are sufficient (when using conventional cracking methods like aircrack-ng). And honestly, I haven’t even tried using Hashcat with a handshake that contains only M1 and M2, given the limitations of my device. So I don’t know why it doesn’t work in Hashcat, while it does work with aircrack-ng 🤔

[TheWarGlory]

i don't get it, if only 2 messages are enought, then why hash cat couldnt crask the hash althought i gave it the password , but when i gave it full 4messages it cracked it easly

That’s something even I don’t understand. As far as I know and based on my testing, M1 and M2 alone are sufficient (when using conventional cracking methods like aircrack-ng). And honestly, I haven’t even tried using Hashcat with a handshake that contains only M1 and M2, given the limitations of my device. So I don’t know why it doesn’t work in Hashcat, while it does work with aircrack-ng 🤔

thats new to learn , ill try this aircrack, and ill let you know if it works for me as well if i only have 2 messages

[Mysteriza]

thats new to learn , ill try this aircrack, and ill let you know if it works for me as well if i only have 2 messages

Sure, speaking of that, you can try out my new tool, which I hope will make it easier for users to crack the handshake. But you should know that it’s still experimental (since I’m working on making it work on Windows as well, and I’m currently developing it so the program can detect whether your device has a discrete GPU that allows you to use Hashcat to speed up the cracking process), so give it a try:
https://github.com/Mysteriza/handshakeCracker

[TheWarGlory]

thats new to learn , ill try this aircrack, and ill let you know if it works for me as well if i only have 2 messages

Sure, speaking of that, you can try out my new tool, which I hope will make it easier for users to crack the handshake. But you should know that it’s still experimental (since I’m working on making it work on Windows as well, and I’m currently developing it so the program can detect whether your device has a discrete GPU that allows you to use Hashcat to speed up the cracking process), so give it a try: https://github.com/Mysteriza/handshakeCracker

ill give it a try after i get how to used numbers combinations in aircrack