From 4069887cf6a8627565fa946941e07f557fc83a28 Mon Sep 17 00:00:00 2001 From: Simone Margaritelli Date: Sat, 26 Oct 2019 10:16:40 +0200 Subject: [PATCH] fix: do not save dummy/invalid half handshakes --- modules/wifi/wifi_recon_handshakes.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/wifi/wifi_recon_handshakes.go b/modules/wifi/wifi_recon_handshakes.go index e89ecba8..a5e2fc96 100644 --- a/modules/wifi/wifi_recon_handshakes.go +++ b/modules/wifi/wifi_recon_handshakes.go @@ -99,9 +99,14 @@ func (mod *WiFiModule) discoverHandshakes(radiotap *layers.RadioTap, dot11 *laye } } - // if we had unsaved packets and either the handshake is half, complete - // or it contains the PMKID, generate a new event. - if doSave && (rawPMKID != nil || station.Handshake.Half() || station.Handshake.Complete()) { + validPMKID := rawPMKID != nil + validHalfHandshake := !staIsUs && station.Handshake.Half() + validFullHandshake := station.Handshake.Complete() + // if we have unsaved packets AND + // if we captured a PMKID OR + // if we captured am half handshake which is not ours OR + // if we captured a full handshake + if doSave && (validPMKID || validHalfHandshake || validFullHandshake) { mod.Session.Events.Add("wifi.client.handshake", HandshakeEvent{ File: shakesFileName, NewPackets: numUnsaved,