WPS (Wi-Fi Protected Setup) is a protocol that attempts to allow easy establishment of a secure wireless home network.

learn more… | top users | synonyms

2
votes
1answer
85 views

How does Dumper program get default WPS without bruteforcing them?

Today I tried a program called Dumper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: I had to cover BSSID and ESSID of the ...
0
votes
1answer
55 views

WPS and WPA2 connection methods

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
5
votes
1answer
258 views

Why some routers ask for PIN but can't be cracked using PIN-based attacks?

I've been working with WPS assessment tools like Reaver and Bully for some time and i could successfully crack my router's PIN code and find its password on both QSS PBC and QSS PIN code. when each of ...
2
votes
2answers
226 views

How visible is a WPS attack with reaver?

I have been trying to find an answer to this but the search terms seem to be to ambiguous. I am attempting to determine from a strategic standpoint how intelligent it is to use reaver. From a ...
-1
votes
2answers
513 views

How to make Reaver crack WPS faster [closed]

I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
3
votes
2answers
1k views

WPA/WPA2 attacks

How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
1
vote
1answer
652 views

Why is it not possible to capture a WPS handshake to WLAN

There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS ...
1
vote
1answer
114 views

Why was WPS not patched to make it secure?

A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits). However, since the flaw was discovered, why ...
1
vote
1answer
534 views

Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools?

I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities. What I am really unable to realize is why it ...
11
votes
2answers
2k views

What is the purpose of changing the default SSID?

Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
3
votes
1answer
889 views

WiFi Direct/WPS key question

So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection. Tools like Reaver ...
2
votes
2answers
388 views

Where does the WPS Pin fit into the 4-way-handshake?

So I found a diagram online, that shows the 4-way-handshake: The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication ...
0
votes
1answer
7k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?