On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame.
There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any trace of it in the router configuration either.
How can I check that the router doesn't effectively offer a WPS PIN based variant, and that I'm safe while the WPS PBC feature is not active?
The best method is to try I think. Scan your network with wash... or even better using airodump-ng with the --wps parameter . This parameter is availabe since 1.2 rc2 version I think (not sure). If you leave the scanning some minutes, some extra info starts to appear... like PBC and other stuff.
Then, if you want to try, I recommend to try to connect to the AP using bully or reaver and using the known PIN only to test. You will see that you can't... and then you can press the button and try again. You will see if now you can connect. And that's all you need.
In my opinion the best option is disable WPS... anyway PBC is good option if enabled by default (a lot of home routers has this today activated by default). Anyway, some routers which are vulnerable to Pixie Dust attacks can be "half-hacked" even with PBC activated... I mean, if the router is vulnerable to Pixie-Dust attack and you have the PBC option activated, it will discover the PIN anyway... but only the PIN because then it can try that PIN to obtain the key but PBC not allow it.
As a final suggestion, I can recommend to you a script on which I'm collaborating. With it you can test all of this stuff in a very very easy way. Is airgeddon . Easy to install (is a bash script), easy to test and automatize all the processes. It has a special WPS section for all of this stuff.
