WPS (Wi-Fi Protected Setup) is a protocol that attempts to allow easy establishment of a secure wireless home network.

learn more… | top users | synonyms

4
votes
1answer
58 views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
3
votes
1answer
121 views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
3
votes
1answer
69 views

Why use WPS on an unsecured WiFi AP?

I was searching for my home WiFi AP (router's broken and am trying to fix it), when I found a WiFi access point that does not have any security but does have WPS enabled: Thinking that it probably ...
5
votes
1answer
205 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
1
vote
1answer
412 views

Dumpper and Jumpstart for hacking WPS

As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them. But with another tool called Jumpstart, together they can crack any AP that is running ...
1
vote
1answer
154 views

How to optimize cracking speed with Reaver

When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
2
votes
1answer
51 views

Is a “standalone WPS server” possible?

Wi-Fi Protected Setup (WPS) is a network security standard to create a secure wireless home network. It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button,...
1
vote
1answer
103 views

Wi-Fi Protected Setup PIN method EAP Messages

Let's look at this example: router (access point) has 8-digit PIN (printed on label) and laptop wants to connect to network using WPS PIN. So user give router's PIN into laptop and laptop sends PIN to ...
3
votes
0answers
37 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
7
votes
2answers
451 views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
0
votes
0answers
2k views

reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))

I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)). I ...
3
votes
1answer
105 views

Does WPS actually send passphrase?

As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established? If so, Why does it need to send PSK? I mean, if the session ...
1
vote
1answer
48 views

Enabled WPS methods

I would like to know if there are tools available to identify what WPS method is actually enabled on an AP? I would like to know also if there is a way by looking at packets to know which WPS method ...
6
votes
1answer
9k views

How does Dumpper program get default WPS without bruteforcing them?

Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: I had to cover BSSID and ESSID of ...
0
votes
1answer
149 views

WPS and WPA2 connection methods

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
4
votes
1answer
2k views

Why some routers ask for PIN but can't be cracked using PIN-based attacks?

I've been working with WPS assessment tools like Reaver and Bully for some time and i could successfully crack my router's PIN code and find its password on both QSS PBC and QSS PIN code. when each of ...
2
votes
2answers
2k views

How visible is a WPS attack with reaver?

I have been trying to find an answer to this but the search terms seem to be to ambiguous. I am attempting to determine from a strategic standpoint how intelligent it is to use reaver. From a ...
-1
votes
2answers
3k views

How to make Reaver crack WPS faster [closed]

I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
4
votes
1answer
7k views

WPA/WPA2 attacks

How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
0
votes
1answer
1k views

Why is it not possible to capture a WPS handshake to WLAN

There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS ...
4
votes
2answers
204 views

Why was WPS not patched to make it secure?

A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits). However, since the flaw was discovered, why ...
1
vote
1answer
950 views

Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools?

I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities. What I am really unable to realize is why it ...
11
votes
3answers
5k views

What is the purpose of changing the default SSID?

Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
3
votes
1answer
2k views

WiFi Direct/WPS key question

So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection. Tools like Reaver ...
2
votes
2answers
699 views

Where does the WPS Pin fit into the 4-way-handshake?

So I found a diagram online, that shows the 4-way-handshake: The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication ...
-1
votes
1answer
10k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?