I read an article on this site, but didn't get what I wanted so my concerns are:

  1. How does pixie dust attack work?
  2. What is the flaw that only certain routers contain to being vulnerable for Pixie-Dust attack?
  • I read a article on some site. Please add a link – Jan Doggen Jan 23 '17 at 11:11
  • Did you tried this software to automatize Pixie Dust attacks? – OscarAkaElvis Jan 23 '17 at 13:40
  • @OscarAkaElvis Will surely check – Shubham Wagh Jan 23 '17 at 14:16
up vote 8 down vote accepted

A Pixie-Dust attack works by bruteforcing the key for a protocol called WPS. WPS was intended to make accessing a router easier, and it did - for attackers.

A WPS Pin consists of 8 digits - two Pre-Shared-Keys or PSKs. Each PSK has half the pin. To understand how a Pixie Dust attack works, you'll need to understand how the requests to the AP work:

1. Computer sends - EAPOL Start

2. Router sends - EAP-Request for the Identity

3. Computer sends - Responds with the Identity

4. Router sends - EAP request

5. Computer sends - EAP response
...

And it loops these requests a few more times before the credentials are sent.

However, during this process, your computer has been given the following:

  • Diffie Hellman Public key of the Enrolee

  • Diffie Hellman Public key of the Registrar

  • Two hashes - of the WPS PIN

  • Enrolee nonce and a derived authkey

; Now in order to successfully bruteforce the previously mentioned PSKs, you'll need two more nonces - which are supposed to be randomly generated. And this is the most important part - since the random numbers are not really random but are derivations of the hashes (or are just zeroes) then we can bruteforce this key, even on a slow system! It will work if the implementation on the router is bad (which it is in most cases) and you should be able to find a list of vulnerable routers on the internet.

tl;dr: We bruteforce a badly generated key because of a flaw in how the random numbers are generated in many routers.

  • So it means it's just like reaver but bruteforce PSKs instead wps pin and is very fast? – Shubham Wagh Jan 23 '17 at 11:23
  • @ShubhamWagh Reaver is a pixie dust attack. You haven't understood what I said - the pin IS THE PSK. 8 digits - broken into two halves and hashed. We hash possibilities until they match and find the pin. – thel3l Jan 23 '17 at 11:25
  • 1
    @ShubhamWagh - you may want to do a little homework on the basics of networking before breaking into WPS bruteforce - it'll help you not join the masses of skiddies out there. – thel3l Jan 23 '17 at 11:26
  • 2
    Here you have a very explicative pdf about it, done by Dominique Bongard archive.hack.lu/2014/… – OscarAkaElvis Jan 23 '17 at 13:51
  • 1
    Bit late, but for anyone caring about the difference, reaver abuses an error code, and bruteforces against the acces point. Pixie captures a derivative of the key and bruteforces it locally. – J.A.K. Sep 4 '17 at 16:46

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.