arsenal/reaver

reaver

WPS PIN attack · GPL-2.0

Attacks the WPS PIN, a design flaw that can hand over a WPA passphrase regardless of how strong it is. If you find WPS enabled on your own router, this shows you why to turn it off.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Install

Install from your distribution's repositories.

$ sudo emerge net-wireless/reaver # Gentoo

$ sudo apt install reaver # Debian / Ubuntu / Kali

$ sudo dnf install reaver # Fedora (RPM Fusion)

02Why a strong passphrase does not save you

WPS was meant to make joining wifi easy: type an eight-digit PIN instead of a long passphrase. The flaw is in how that PIN is checked. The router validates it in two halves and tells you when the first half is right, which collapses the search from a hundred million guesses to about eleven thousand. Worse, many routers leak enough during the first exchange that the PIN can be computed offline in seconds, the Pixie Dust attack. Once the PIN falls, the router simply hands over the WPA passphrase, no matter how long and random it is.

» reaver brute-forces the WPS PIN online, half at a time.

» Pixie Dust (reaver -K) computes the PIN offline when the router is vulnerable, often in under a minute.

» bully is an alternative implementation of the same attacks, useful when reaver struggles with a particular router.

» Success yields the WPA/WPA2 passphrase directly, bypassing its strength entirely.

03Find WPS-enabled access points

Not every network runs WPS, and not every WPS network is locked. The wash tool, part of the reaver package, scans for access points with WPS enabled and tells you whether WPS is locked and which version it runs. Put your card in monitor mode first, as in the aircrack-ng guide.

$ sudo airmon-ng start wlan0

$ sudo wash -i wlan0mon

» Lck tells you whether WPS is locked. A No in that column, as on HomeLab and OldRouter, means the access point will answer PIN attempts. Office-WiFi is locked and will rate-limit or refuse, which is itself a small mercy.

↑ contents

04Pixie Dust first: the fast path

Always try Pixie Dust before a full brute force. It is offline against the data from a single exchange, so when it works it is nearly instant, and it does not hammer the router. The -K 1 flag turns it on.

$ sudo reaver -i wlan0mon -b AA:BB:CC:11:22:33 -c 6 -K 1 -vv

» That is the whole attack in one shot: PIN recovered offline, and the WPA PSK handed over with it. If the router is not vulnerable to Pixie Dust, reaver says so and you fall back to the online brute force.

05Online PIN brute force

When Pixie Dust fails, reaver walks the PIN space online. Because of the half-at-a-time flaw this is still far smaller than it sounds, but it is slow and noisy, and routers may lock WPS after too many attempts. reaver saves progress, so you can stop and resume.

$ sudo reaver -i wlan0mon -b AA:BB:CC:11:22:33 -c 6 -vv -d 2 -T 0.5

» The -d and -T flags add delays to be gentler on the router and dodge lockouts. If reaver reports WPS locked mid-run, pause and let the router recover, or the attempt will stall. When reaver struggles, try bully on the same target as a second opinion.

↑ contents

06The fix is simple: turn WPS off

This is the rare attack with a single, complete defence. WPS exists only for convenience, and the convenience is not worth the hole.

» Disable WPS entirely in your router's admin page; join devices with the passphrase instead.

» After disabling, confirm with wash that your BSSID no longer appears, or shows WPS locked.

» If your router has no option to disable WPS, that alone is a reason to replace it.

» A strong WPA passphrase is necessary but not sufficient here; with WPS on, the passphrase strength is irrelevant.

» Re-scan your own estate periodically; a firmware update or factory reset can quietly turn WPS back on.

If reaver pulls your passphrase through WPS in under a minute, no change to that passphrase will help. Turn WPS off, re-scan, and confirm the door is closed.

↑ contents