When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of 20s, small DH keys and no nacks, but I guess the delay could be much shorter for such a router.

What do you say about default value of 1s and what approach would you - and generally do you prefer?

  • isn't it up to each individual router, firmware, and situation? – schroeder Feb 18 '16 at 20:40
  • I am very new to this matter and looking for some experiences. I wonder how to recognize which settings fit the situation best to successful and optimized offense. With parameters as above I get WARNING: Detected AP rate limiting message which persist even with longer delay between pin attempts. I've tried to ignore locks state I don't think that it really helps. – Stanislav Jirák Feb 18 '16 at 21:03
  • I would say the router might have blocked my MAC after some attempts... – Stanislav Jirák Feb 18 '16 at 21:11

The WPS PIN vulnerability is an online brute-force attack: you make a guess at the PIN, and the router tells you if it's correct or not. Because of this, the limiting factor for attack speed is how fast the router is willing to talk to you.

You can speed things up slightly by using small DH values to reduce the amount of computation the router needs to perform, and by reducing how long you wait between guesses, but if the router is rate-limiting you, there's not much you can do.

  • Is there any way how can I keep changing my MAC and checking WPS pins? – Stanislav Jirák Feb 18 '16 at 22:00
  • You can try changing your MAC, but it shouldn't make any difference to the router because it's so easy to do. – Mark Feb 18 '16 at 22:16
  • I'll try tomorrow (+1 GMT). – Stanislav Jirák Feb 18 '16 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.