1

I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities.

What I am really unable to realize is why it is necessary to set the network card on the bruteforcing device in monitor mode. Monitor mode allows to inspect traffic from any network no matter if you're associated to them or not, and to transmit packets in any network as well - that is, packet injection.

Why is packet injection required for WPS cracking, though? Since reaver do associate with the AP before starting to try PINs, to me it just looks it is behaving like any client trying to do the WPS pin exchange. Just, a quite insistent client :).

So, I can't realize why is monitor mode necessary for it. Thank you very much for any clarifications.

Improve this question
1
  • FYI: Monitor mode is not enough. I had a network card that was able to attack WEP w/ aircrack on lunix but not WPS.
    – Smit Johnth
    Commented Jul 11, 2017 at 18:44

1 Answer 1

Reset to default
4

Some of the options, such as Reaver's "ignore frame checksum errors" or Bully's "don't require ACKs" are technically violations of the WiFi spec, and can't be done by a device that's in managed mode. Additionally, I suspect that being in monitor mode is required to see the beacon packets that 1) tell if the AP supports WPS, and 2) tell if the AP has temporarily locked WPS access.

In general, people developing tools such as Reaver or Bully want to maximize their control over the process, which means working in monitor mode.

Improve this answer
3
  • thank you for your reply. I would like to be sure if your suspects are correct or not, waiting for more feedback. Something that does not leave me 100 percent sure is, how a normal handeld could use wps to legitimally connect to a router, if monitor mode would be mandatory to detect if the router supports it? It doesn't make much sense. Having more control over certain situations does, but why requiring it then if most cases won't need it? That reduces by far the specrum of the allowed hardware from ANY card to a subset of them. Thanks
    – Dakatine
    Commented Mar 8, 2014 at 9:56
  • I gave it a try by running it with a managed mode interface, just to try to solve the mistery. It was not even able to associate, although I really cannot understand the reason why!
    – Dakatine
    Commented Mar 9, 2014 at 21:56
  • "Reaver's "ignore frame checksum errors" - why is it needed? Because of flawed drivers?
    – Smit Johnth
    Commented Jul 11, 2017 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .