358 lines
11 KiB
Bash
358 lines
11 KiB
Bash
#!/bin/bash
|
|
|
|
# Handshake Verification and Statistics Script
|
|
# Analyzes CAP/PCAP files for valid WPA/WPA2 handshakes before cracking
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORKSPACE_DIR="$(dirname "$SCRIPT_DIR")"
|
|
|
|
# Configuration
|
|
INPUT_DIR="$WORKSPACE_DIR/input"
|
|
CONVERTED_DIR="$WORKSPACE_DIR/converted"
|
|
RESULTS_DIR="$WORKSPACE_DIR/results"
|
|
VERIFY_DIR="$WORKSPACE_DIR/verification"
|
|
REPORT_FILE="$VERIFY_DIR/handshake_report_$(date +%Y%m%d_%H%M%S).txt"
|
|
|
|
# Colors for output
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Create directories
|
|
mkdir -p "$VERIFY_DIR" "$RESULTS_DIR"
|
|
|
|
# Function to print colored messages
|
|
print_info() {
|
|
echo -e "${BLUE}[INFO]${NC} $1"
|
|
}
|
|
|
|
print_success() {
|
|
echo -e "${GREEN}[SUCCESS]${NC} $1"
|
|
}
|
|
|
|
print_warning() {
|
|
echo -e "${YELLOW}[WARNING]${NC} $1"
|
|
}
|
|
|
|
print_error() {
|
|
echo -e "${RED}[ERROR]${NC} $1"
|
|
}
|
|
|
|
# Function to check if tools are available
|
|
check_tools() {
|
|
local tools=("hcxpcapngtool" "tshark" "capinfos")
|
|
local missing=()
|
|
|
|
for tool in "${tools[@]}"; do
|
|
if ! command -v "$tool" &> /dev/null; then
|
|
missing+=("$tool")
|
|
fi
|
|
done
|
|
|
|
if [ ${#missing[@]} -gt 0 ]; then
|
|
print_warning "Missing tools: ${missing[*]}"
|
|
print_info "Some verification features may be limited"
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
# Function to analyze CAP/PCAP file with hcxpcapngtool
|
|
analyze_with_hcxpcapngtool() {
|
|
local input_file="$1"
|
|
local output_file="$2"
|
|
|
|
print_info "Analyzing: $(basename "$input_file")"
|
|
|
|
# Run hcxpcapngtool with verbose output
|
|
local analysis_output
|
|
analysis_output=$(hcxpcapngtool -v "$input_file" 2>&1 || true)
|
|
|
|
# Extract key information
|
|
local handshake_count=$(echo "$analysis_output" | grep -c "EAPOL pairs" || echo "0")
|
|
local pmkid_count=$(echo "$analysis_output" | grep -c "PMKID(s)" || echo "0")
|
|
local valid_handshake="NO"
|
|
|
|
if [ "$handshake_count" -gt 0 ] || [ "$pmkid_count" -gt 0 ]; then
|
|
valid_handshake="YES"
|
|
fi
|
|
|
|
# Save detailed analysis
|
|
echo "=== Analysis of $(basename "$input_file") ===" > "$output_file"
|
|
echo "File: $input_file" >> "$output_file"
|
|
echo "Size: $(du -h "$input_file" | cut -f1)" >> "$output_file"
|
|
echo "Analysis Time: $(date)" >> "$output_file"
|
|
echo "" >> "$output_file"
|
|
echo "$analysis_output" >> "$output_file"
|
|
|
|
# Return summary
|
|
echo "$valid_handshake:$handshake_count:$pmkid_count"
|
|
}
|
|
|
|
# Function to analyze with tshark (Wireshark)
|
|
analyze_with_tshark() {
|
|
local input_file="$1"
|
|
local output_file="$2"
|
|
|
|
print_info "Running packet analysis with tshark..."
|
|
|
|
# Check for EAPOL packets (WPA handshake)
|
|
local eapol_count=$(tshark -r "$input_file" -Y "eapol" 2>/dev/null | wc -l || echo "0")
|
|
|
|
# Check for beacon frames to identify networks
|
|
local beacon_info=$(tshark -r "$input_file" -Y "wlan.fc.type_subtype == 0x0008" -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | head -5 || echo "No beacon frames")
|
|
|
|
# Get packet count and duration
|
|
local packet_count=$(capinfos -c "$input_file" 2>/dev/null | grep "Number of packets" | cut -d: -f2 | tr -d ' ' || echo "N/A")
|
|
local duration=$(capinfos -a "$input_file" 2>/dev/null | grep "Capture duration" | cut -d: -f2 | tr -d ' ' || echo "N/A")
|
|
|
|
# Append to output file
|
|
echo "" >> "$output_file"
|
|
echo "=== Wireshark Analysis ===" >> "$output_file"
|
|
echo "Total packets: $packet_count" >> "$output_file"
|
|
echo "Capture duration: $duration" >> "$output_file"
|
|
echo "EAPOL packets (handshake): $eapol_count" >> "$output_file"
|
|
echo "Beacon frames (networks):" >> "$output_file"
|
|
echo "$beacon_info" >> "$output_file"
|
|
|
|
echo "$eapol_count"
|
|
}
|
|
|
|
# Function to generate summary report
|
|
generate_summary_report() {
|
|
local summary_file="$1"
|
|
shift
|
|
local files=("$@")
|
|
|
|
print_info "Generating summary report..."
|
|
|
|
cat > "$summary_file" << 'EOF'
|
|
HANDSHAKE VERIFICATION REPORT
|
|
=============================
|
|
Generated: $(date)
|
|
|
|
SUMMARY
|
|
-------
|
|
EOF
|
|
|
|
local total_files=0
|
|
local valid_files=0
|
|
local total_handshakes=0
|
|
local total_pmkids=0
|
|
|
|
for file in "${files[@]}"; do
|
|
if [ -f "$file" ]; then
|
|
total_files=$((total_files + 1))
|
|
|
|
# Get analysis results
|
|
local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
|
|
if [ -f "$analysis_file" ]; then
|
|
local valid_line=$(grep -E "^YES:|^NO:" "$analysis_file" | head -1)
|
|
if [[ "$valid_line" == YES:* ]]; then
|
|
valid_files=$((valid_files + 1))
|
|
IFS=':' read -r valid handshakes pmkids <<< "$valid_line"
|
|
total_handshakes=$((total_handshakes + handshakes))
|
|
total_pmkids=$((total_pmkids + pmkids))
|
|
fi
|
|
fi
|
|
fi
|
|
done
|
|
|
|
cat >> "$summary_file" << EOF
|
|
|
|
Statistics:
|
|
- Total files analyzed: $total_files
|
|
- Files with valid handshakes: $valid_files
|
|
- Total EAPOL pairs found: $total_handshakes
|
|
- Total PMKIDs found: $total_pmkids
|
|
|
|
RECOMMENDATIONS
|
|
---------------
|
|
EOF
|
|
|
|
if [ "$valid_files" -eq 0 ]; then
|
|
cat >> "$summary_file" << EOF
|
|
❌ NO VALID HANDSHAKES FOUND
|
|
- None of the capture files contain valid WPA/WPA2 handshakes
|
|
- Recapture is required before cracking can proceed
|
|
- Ensure you capture the 4-way handshake or PMKID
|
|
EOF
|
|
elif [ "$valid_files" -lt "$total_files" ]; then
|
|
cat >> "$summary_file" << EOF
|
|
⚠️ PARTIAL HANDSHAKES FOUND
|
|
- $valid_files out of $total_files files contain handshakes
|
|
- Consider recapturing missing handshakes
|
|
- Proceed with cracking for files that have handshakes
|
|
EOF
|
|
else
|
|
cat >> "$summary_file" << EOF
|
|
✅ ALL FILES HAVE VALID HANDSHAKES
|
|
- All $total_files files contain handshakes
|
|
- Ready for cracking
|
|
- Total handshake material: $total_handshakes EAPOL pairs, $total_pmkids PMKIDs
|
|
EOF
|
|
fi
|
|
|
|
cat >> "$summary_file" << EOF
|
|
|
|
DETAILED ANALYSIS
|
|
-----------------
|
|
EOF
|
|
|
|
for file in "${files[@]}"; do
|
|
if [ -f "$file" ]; then
|
|
local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
|
|
if [ -f "$analysis_file" ]; then
|
|
echo "" >> "$summary_file"
|
|
echo "File: $(basename "$file")" >> "$summary_file"
|
|
grep -E "^(EAPOL pairs|PMKID|YES:|NO:)" "$analysis_file" | head -5 >> "$summary_file"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
cat >> "$summary_file" << EOF
|
|
|
|
NEXT STEPS
|
|
----------
|
|
1. Files with handshakes will be converted to hashcat format
|
|
2. Conversion output: $CONVERTED_DIR/
|
|
3. Run cracking with: ./auto_crack.sh or ./scripts/crack_pipeline.sh
|
|
|
|
Report saved: $summary_file
|
|
EOF
|
|
}
|
|
|
|
# Function to display quick statistics
|
|
display_quick_stats() {
|
|
local files=("$@")
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "QUICK HANDSHAKE STATISTICS"
|
|
echo "=========================================="
|
|
|
|
local file_count=0
|
|
local valid_count=0
|
|
|
|
for file in "${files[@]}"; do
|
|
if [ -f "$file" ]; then
|
|
file_count=$((file_count + 1))
|
|
local filename=$(basename "$file")
|
|
|
|
# Quick check with hcxpcapngtool
|
|
local quick_check=$(hcxpcapngtool -v "$file" 2>&1 | grep -E "(EAPOL pairs|PMKID)" || true)
|
|
|
|
if echo "$quick_check" | grep -q "EAPOL pairs: [1-9]" || echo "$quick_check" | grep -q "PMKID(s): [1-9]"; then
|
|
echo -e "${GREEN}✓${NC} $filename: VALID handshake found"
|
|
valid_count=$((valid_count + 1))
|
|
|
|
# Extract counts
|
|
local eapol=$(echo "$quick_check" | grep "EAPOL pairs" | grep -o '[0-9]*' || echo "0")
|
|
local pmkid=$(echo "$quick_check" | grep "PMKID(s)" | grep -o '[0-9]*' || echo "0")
|
|
echo " EAPOL pairs: $eapol, PMKIDs: $pmkid"
|
|
else
|
|
echo -e "${RED}✗${NC} $filename: NO valid handshake"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
echo ""
|
|
echo "Summary: $valid_count/$file_count files have valid handshakes"
|
|
|
|
if [ "$valid_count" -eq 0 ]; then
|
|
echo -e "${RED}❌ No valid handshakes found. Recapture required.${NC}"
|
|
return 1
|
|
elif [ "$valid_count" -lt "$file_count" ]; then
|
|
echo -e "${YELLOW}⚠️ Some files missing handshakes. Consider recapturing.${NC}"
|
|
return 0
|
|
else
|
|
echo -e "${GREEN}✅ All files have valid handshakes. Ready for cracking.${NC}"
|
|
return 0
|
|
fi
|
|
}
|
|
|
|
# Main function
|
|
main() {
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "HANDSHAKE VERIFICATION & STATISTICS"
|
|
echo "=========================================="
|
|
|
|
# Check for tools
|
|
check_tools
|
|
|
|
# Find CAP/PCAP files
|
|
local capture_files=()
|
|
while IFS= read -r -d $'\0' file; do
|
|
capture_files+=("$file")
|
|
done < <(find "$INPUT_DIR" -type f \( -name "*.cap" -o -name "*.pcap" -o -name "*.pcapng" \) -print0)
|
|
|
|
if [ ${#capture_files[@]} -eq 0 ]; then
|
|
print_error "No CAP/PCAP files found in $INPUT_DIR/"
|
|
print_info "Please place capture files in the input directory"
|
|
exit 1
|
|
fi
|
|
|
|
print_info "Found ${#capture_files[@]} capture file(s)"
|
|
|
|
# Display quick statistics
|
|
display_quick_stats "${capture_files[@]}"
|
|
local quick_status=$?
|
|
|
|
echo ""
|
|
print_info "Running detailed analysis..."
|
|
|
|
# Analyze each file
|
|
local analysis_results=()
|
|
for capture_file in "${capture_files[@]}"; do
|
|
local analysis_file="$VERIFY_DIR/$(basename "$capture_file").analysis.txt"
|
|
local result=$(analyze_with_hcxpcapngtool "$capture_file" "$analysis_file")
|
|
|
|
# Also run tshark analysis if available
|
|
if command -v tshark &> /dev/null; then
|
|
analyze_with_tshark "$capture_file" "$analysis_file"
|
|
fi
|
|
|
|
analysis_results+=("$result")
|
|
|
|
# Display result
|
|
IFS=':' read -r valid handshakes pmkids <<< "$result"
|
|
if [ "$valid" = "YES" ]; then
|
|
print_success "$(basename "$capture_file"): $handshakes EAPOL pairs, $pmkids PMKIDs"
|
|
else
|
|
print_warning "$(basename "$capture_file"): No valid handshake"
|
|
fi
|
|
done
|
|
|
|
# Generate comprehensive report
|
|
generate_summary_report "$REPORT_FILE" "${capture_files[@]}"
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "ANALYSIS COMPLETE"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo "Detailed reports saved in: $VERIFY_DIR/"
|
|
echo "Summary report: $REPORT_FILE"
|
|
echo ""
|
|
|
|
# Recommendation
|
|
if [ $quick_status -eq 1 ]; then
|
|
print_error "RECOMMENDATION: Recapture handshakes before cracking"
|
|
else
|
|
print_success "RECOMMENDATION: Proceed with cracking"
|
|
print_info "Run: ./auto_crack.sh or place files in input/ and run main script"
|
|
fi
|
|
|
|
echo ""
|
|
print_info "Next: Files with valid handshakes will be automatically converted"
|
|
print_info " during the cracking workflow."
|
|
}
|
|
|
|
# Run main function
|
|
main "$@" |