Added PMKID attack. Simplified attack-loop.

PMKID.md

@@ -0,0 +1,33 @@
+### PMKID Attack
+
+See https://hashcat.net/forum/thread-7717.html
+
+### Steps
+
+1. Start `hcxdumptool` (daemon)
+   * `sudo hcxdumptool -i wlan1mon -o pmkid.pcapng -t 10 --enable_status=1`
+   * Should also use `-c <channel>`, `--filterlist` and `--filtermode` to target a specific client
+   * Could be a new attack type: `wifite.attack.pmkid`
+2. Detect when PMKID is found.
+   * `hcxpcaptool -z pmkid.16800 pmkid.pcapng`
+   * Single-line in pmkid.16800 will have PMKID, MACAP, MACStation, ESSID (in hex).
+3. Save `.16800` file (to `./hs/`? or `./pmkids/`?)
+   * New result type: `pmkid_result`
+   * Add entry to `cracked.txt`
+4. Run crack attack using hashcat:
+   * `./hashcat64.bin --force -m 16800 -a0 -w2 path/to/pmkid.16800 path/to/wordlist.txt`
+
+### Problems
+
+* Requires latest hashcat to be installed. This might be in a different directory.
+   * Use can specify path to hashcat? Yeck...
+   * % hashcat -h | grep 16800
+   * 16800 | WPA-PMKID-PBKDF2
+* If target can't be attacked... we need to detect this failure mode.
+   * Might need to scrape `hcxdumptool`'s output
+   * Look at `pmkids()` func in .bashrc
+   * hcxpcaptool -z OUTPUT.16800 INPUT.pcapng > /dev/null
+   * Check OUTPUT.16800 for the ESSID.
+* Wireless adapter support is minimal, apparently.
+* hcxdumptool also deauths networks and captures handshakes... maybe unnecessarily
+