first commit
This commit is contained in:
358
scripts/verify_handshakes.sh
Normal file
358
scripts/verify_handshakes.sh
Normal file
@@ -0,0 +1,358 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Handshake Verification and Statistics Script
|
||||
# Analyzes CAP/PCAP files for valid WPA/WPA2 handshakes before cracking
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
WORKSPACE_DIR="$(dirname "$SCRIPT_DIR")"
|
||||
|
||||
# Configuration
|
||||
INPUT_DIR="$WORKSPACE_DIR/input"
|
||||
CONVERTED_DIR="$WORKSPACE_DIR/converted"
|
||||
RESULTS_DIR="$WORKSPACE_DIR/results"
|
||||
VERIFY_DIR="$WORKSPACE_DIR/verification"
|
||||
REPORT_FILE="$VERIFY_DIR/handshake_report_$(date +%Y%m%d_%H%M%S).txt"
|
||||
|
||||
# Colors for output
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Create directories
|
||||
mkdir -p "$VERIFY_DIR" "$RESULTS_DIR"
|
||||
|
||||
# Function to print colored messages
|
||||
print_info() {
|
||||
echo -e "${BLUE}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
print_success() {
|
||||
echo -e "${GREEN}[SUCCESS]${NC} $1"
|
||||
}
|
||||
|
||||
print_warning() {
|
||||
echo -e "${YELLOW}[WARNING]${NC} $1"
|
||||
}
|
||||
|
||||
print_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# Function to check if tools are available
|
||||
check_tools() {
|
||||
local tools=("hcxpcapngtool" "tshark" "capinfos")
|
||||
local missing=()
|
||||
|
||||
for tool in "${tools[@]}"; do
|
||||
if ! command -v "$tool" &> /dev/null; then
|
||||
missing+=("$tool")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ${#missing[@]} -gt 0 ]; then
|
||||
print_warning "Missing tools: ${missing[*]}"
|
||||
print_info "Some verification features may be limited"
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
# Function to analyze CAP/PCAP file with hcxpcapngtool
|
||||
analyze_with_hcxpcapngtool() {
|
||||
local input_file="$1"
|
||||
local output_file="$2"
|
||||
|
||||
print_info "Analyzing: $(basename "$input_file")"
|
||||
|
||||
# Run hcxpcapngtool with verbose output
|
||||
local analysis_output
|
||||
analysis_output=$(hcxpcapngtool -v "$input_file" 2>&1 || true)
|
||||
|
||||
# Extract key information
|
||||
local handshake_count=$(echo "$analysis_output" | grep -c "EAPOL pairs" || echo "0")
|
||||
local pmkid_count=$(echo "$analysis_output" | grep -c "PMKID(s)" || echo "0")
|
||||
local valid_handshake="NO"
|
||||
|
||||
if [ "$handshake_count" -gt 0 ] || [ "$pmkid_count" -gt 0 ]; then
|
||||
valid_handshake="YES"
|
||||
fi
|
||||
|
||||
# Save detailed analysis
|
||||
echo "=== Analysis of $(basename "$input_file") ===" > "$output_file"
|
||||
echo "File: $input_file" >> "$output_file"
|
||||
echo "Size: $(du -h "$input_file" | cut -f1)" >> "$output_file"
|
||||
echo "Analysis Time: $(date)" >> "$output_file"
|
||||
echo "" >> "$output_file"
|
||||
echo "$analysis_output" >> "$output_file"
|
||||
|
||||
# Return summary
|
||||
echo "$valid_handshake:$handshake_count:$pmkid_count"
|
||||
}
|
||||
|
||||
# Function to analyze with tshark (Wireshark)
|
||||
analyze_with_tshark() {
|
||||
local input_file="$1"
|
||||
local output_file="$2"
|
||||
|
||||
print_info "Running packet analysis with tshark..."
|
||||
|
||||
# Check for EAPOL packets (WPA handshake)
|
||||
local eapol_count=$(tshark -r "$input_file" -Y "eapol" 2>/dev/null | wc -l || echo "0")
|
||||
|
||||
# Check for beacon frames to identify networks
|
||||
local beacon_info=$(tshark -r "$input_file" -Y "wlan.fc.type_subtype == 0x0008" -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | head -5 || echo "No beacon frames")
|
||||
|
||||
# Get packet count and duration
|
||||
local packet_count=$(capinfos -c "$input_file" 2>/dev/null | grep "Number of packets" | cut -d: -f2 | tr -d ' ' || echo "N/A")
|
||||
local duration=$(capinfos -a "$input_file" 2>/dev/null | grep "Capture duration" | cut -d: -f2 | tr -d ' ' || echo "N/A")
|
||||
|
||||
# Append to output file
|
||||
echo "" >> "$output_file"
|
||||
echo "=== Wireshark Analysis ===" >> "$output_file"
|
||||
echo "Total packets: $packet_count" >> "$output_file"
|
||||
echo "Capture duration: $duration" >> "$output_file"
|
||||
echo "EAPOL packets (handshake): $eapol_count" >> "$output_file"
|
||||
echo "Beacon frames (networks):" >> "$output_file"
|
||||
echo "$beacon_info" >> "$output_file"
|
||||
|
||||
echo "$eapol_count"
|
||||
}
|
||||
|
||||
# Function to generate summary report
|
||||
generate_summary_report() {
|
||||
local summary_file="$1"
|
||||
shift
|
||||
local files=("$@")
|
||||
|
||||
print_info "Generating summary report..."
|
||||
|
||||
cat > "$summary_file" << 'EOF'
|
||||
HANDSHAKE VERIFICATION REPORT
|
||||
=============================
|
||||
Generated: $(date)
|
||||
|
||||
SUMMARY
|
||||
-------
|
||||
EOF
|
||||
|
||||
local total_files=0
|
||||
local valid_files=0
|
||||
local total_handshakes=0
|
||||
local total_pmkids=0
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "$file" ]; then
|
||||
total_files=$((total_files + 1))
|
||||
|
||||
# Get analysis results
|
||||
local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
|
||||
if [ -f "$analysis_file" ]; then
|
||||
local valid_line=$(grep -E "^YES:|^NO:" "$analysis_file" | head -1)
|
||||
if [[ "$valid_line" == YES:* ]]; then
|
||||
valid_files=$((valid_files + 1))
|
||||
IFS=':' read -r valid handshakes pmkids <<< "$valid_line"
|
||||
total_handshakes=$((total_handshakes + handshakes))
|
||||
total_pmkids=$((total_pmkids + pmkids))
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
cat >> "$summary_file" << EOF
|
||||
|
||||
Statistics:
|
||||
- Total files analyzed: $total_files
|
||||
- Files with valid handshakes: $valid_files
|
||||
- Total EAPOL pairs found: $total_handshakes
|
||||
- Total PMKIDs found: $total_pmkids
|
||||
|
||||
RECOMMENDATIONS
|
||||
---------------
|
||||
EOF
|
||||
|
||||
if [ "$valid_files" -eq 0 ]; then
|
||||
cat >> "$summary_file" << EOF
|
||||
❌ NO VALID HANDSHAKES FOUND
|
||||
- None of the capture files contain valid WPA/WPA2 handshakes
|
||||
- Recapture is required before cracking can proceed
|
||||
- Ensure you capture the 4-way handshake or PMKID
|
||||
EOF
|
||||
elif [ "$valid_files" -lt "$total_files" ]; then
|
||||
cat >> "$summary_file" << EOF
|
||||
⚠️ PARTIAL HANDSHAKES FOUND
|
||||
- $valid_files out of $total_files files contain handshakes
|
||||
- Consider recapturing missing handshakes
|
||||
- Proceed with cracking for files that have handshakes
|
||||
EOF
|
||||
else
|
||||
cat >> "$summary_file" << EOF
|
||||
✅ ALL FILES HAVE VALID HANDSHAKES
|
||||
- All $total_files files contain handshakes
|
||||
- Ready for cracking
|
||||
- Total handshake material: $total_handshakes EAPOL pairs, $total_pmkids PMKIDs
|
||||
EOF
|
||||
fi
|
||||
|
||||
cat >> "$summary_file" << EOF
|
||||
|
||||
DETAILED ANALYSIS
|
||||
-----------------
|
||||
EOF
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "$file" ]; then
|
||||
local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
|
||||
if [ -f "$analysis_file" ]; then
|
||||
echo "" >> "$summary_file"
|
||||
echo "File: $(basename "$file")" >> "$summary_file"
|
||||
grep -E "^(EAPOL pairs|PMKID|YES:|NO:)" "$analysis_file" | head -5 >> "$summary_file"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
cat >> "$summary_file" << EOF
|
||||
|
||||
NEXT STEPS
|
||||
----------
|
||||
1. Files with handshakes will be converted to hashcat format
|
||||
2. Conversion output: $CONVERTED_DIR/
|
||||
3. Run cracking with: ./auto_crack.sh or ./scripts/crack_pipeline.sh
|
||||
|
||||
Report saved: $summary_file
|
||||
EOF
|
||||
}
|
||||
|
||||
# Function to display quick statistics
|
||||
display_quick_stats() {
|
||||
local files=("$@")
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo "QUICK HANDSHAKE STATISTICS"
|
||||
echo "=========================================="
|
||||
|
||||
local file_count=0
|
||||
local valid_count=0
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "$file" ]; then
|
||||
file_count=$((file_count + 1))
|
||||
local filename=$(basename "$file")
|
||||
|
||||
# Quick check with hcxpcapngtool
|
||||
local quick_check=$(hcxpcapngtool -v "$file" 2>&1 | grep -E "(EAPOL pairs|PMKID)" || true)
|
||||
|
||||
if echo "$quick_check" | grep -q "EAPOL pairs: [1-9]" || echo "$quick_check" | grep -q "PMKID(s): [1-9]"; then
|
||||
echo -e "${GREEN}✓${NC} $filename: VALID handshake found"
|
||||
valid_count=$((valid_count + 1))
|
||||
|
||||
# Extract counts
|
||||
local eapol=$(echo "$quick_check" | grep "EAPOL pairs" | grep -o '[0-9]*' || echo "0")
|
||||
local pmkid=$(echo "$quick_check" | grep "PMKID(s)" | grep -o '[0-9]*' || echo "0")
|
||||
echo " EAPOL pairs: $eapol, PMKIDs: $pmkid"
|
||||
else
|
||||
echo -e "${RED}✗${NC} $filename: NO valid handshake"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Summary: $valid_count/$file_count files have valid handshakes"
|
||||
|
||||
if [ "$valid_count" -eq 0 ]; then
|
||||
echo -e "${RED}❌ No valid handshakes found. Recapture required.${NC}"
|
||||
return 1
|
||||
elif [ "$valid_count" -lt "$file_count" ]; then
|
||||
echo -e "${YELLOW}⚠️ Some files missing handshakes. Consider recapturing.${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${GREEN}✅ All files have valid handshakes. Ready for cracking.${NC}"
|
||||
return 0
|
||||
fi
|
||||
}
|
||||
|
||||
# Main function
|
||||
main() {
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo "HANDSHAKE VERIFICATION & STATISTICS"
|
||||
echo "=========================================="
|
||||
|
||||
# Check for tools
|
||||
check_tools
|
||||
|
||||
# Find CAP/PCAP files
|
||||
local capture_files=()
|
||||
while IFS= read -r -d $'\0' file; do
|
||||
capture_files+=("$file")
|
||||
done < <(find "$INPUT_DIR" -type f \( -name "*.cap" -o -name "*.pcap" -o -name "*.pcapng" \) -print0)
|
||||
|
||||
if [ ${#capture_files[@]} -eq 0 ]; then
|
||||
print_error "No CAP/PCAP files found in $INPUT_DIR/"
|
||||
print_info "Please place capture files in the input directory"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_info "Found ${#capture_files[@]} capture file(s)"
|
||||
|
||||
# Display quick statistics
|
||||
display_quick_stats "${capture_files[@]}"
|
||||
local quick_status=$?
|
||||
|
||||
echo ""
|
||||
print_info "Running detailed analysis..."
|
||||
|
||||
# Analyze each file
|
||||
local analysis_results=()
|
||||
for capture_file in "${capture_files[@]}"; do
|
||||
local analysis_file="$VERIFY_DIR/$(basename "$capture_file").analysis.txt"
|
||||
local result=$(analyze_with_hcxpcapngtool "$capture_file" "$analysis_file")
|
||||
|
||||
# Also run tshark analysis if available
|
||||
if command -v tshark &> /dev/null; then
|
||||
analyze_with_tshark "$capture_file" "$analysis_file"
|
||||
fi
|
||||
|
||||
analysis_results+=("$result")
|
||||
|
||||
# Display result
|
||||
IFS=':' read -r valid handshakes pmkids <<< "$result"
|
||||
if [ "$valid" = "YES" ]; then
|
||||
print_success "$(basename "$capture_file"): $handshakes EAPOL pairs, $pmkids PMKIDs"
|
||||
else
|
||||
print_warning "$(basename "$capture_file"): No valid handshake"
|
||||
fi
|
||||
done
|
||||
|
||||
# Generate comprehensive report
|
||||
generate_summary_report "$REPORT_FILE" "${capture_files[@]}"
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo "ANALYSIS COMPLETE"
|
||||
echo "=========================================="
|
||||
echo ""
|
||||
echo "Detailed reports saved in: $VERIFY_DIR/"
|
||||
echo "Summary report: $REPORT_FILE"
|
||||
echo ""
|
||||
|
||||
# Recommendation
|
||||
if [ $quick_status -eq 1 ]; then
|
||||
print_error "RECOMMENDATION: Recapture handshakes before cracking"
|
||||
else
|
||||
print_success "RECOMMENDATION: Proceed with cracking"
|
||||
print_info "Run: ./auto_crack.sh or place files in input/ and run main script"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
print_info "Next: Files with valid handshakes will be automatically converted"
|
||||
print_info " during the cracking workflow."
|
||||
}
|
||||
|
||||
# Run main function
|
||||
main "$@"
|
||||
Reference in New Issue
Block a user