I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP)

Another question is about Reaver-WPS, what if an access point doesn't support WPS, or is disabled? Will Reaver work on such AP

  • 1
    I don't have sources so I won't write an Answer, but no - you can go past WPA without brute-forcing it. It just that the math is complicated enough that running through the most common passwords first is probably faster for the intruder in many cases.
    – shieldfoss
    Jul 30, 2013 at 7:03
  • 2
    If WPS is disabled then the exploit against WPS won't work. If you have questions about WPA I suggest you do some research on the algorithm.
    – Ramhound
    Jul 30, 2013 at 11:42
  • Yes, WPA can be cracked without brute force. news.dice.com/2014/03/20/…
    – user69354
    Mar 1, 2015 at 0:45

1 Answer 1


WPA can be used with different protocols. Using WPA-TKIP, there are alternative attacks than the common handshake-bruteforce, but those will not grant you access to the AP. These attacks focus on RC4 weaknesses (similar to WEP, but far less effective due to successful countermeasures).

I assume that you want to acces an AP. In this case, bruteforcing is the only possible way to crack WPA. You capture a handshake between client and accesspoint, and perform the challenge-response yourself with different passwords, until your result matches the one you captured.

This can be sped up by using rainbow-tables, although you will have to find a target using a popular SSID in order to have an existing rainbow table.

Thus, to protect against intruders, you should choose an uncommon SSID along with a fairly long and complex password.

And no, you can not attack WPS when WPS is disabled or not supported. There may be bugs preventing a user from disabling WPS, but i consider these APs WPS-enabled.

  • You might want to add a reference the "shoulder-surfing" (and similar) class of attacks to your answer: that usually the easiest way to grab a WAP/WEP password.
    – Stephane
    Oct 30, 2013 at 10:37
  • @Stephane a legitimate user will not type password everytime, however social engineering attacks always works
    – Mark Evans
    Oct 31, 2013 at 3:48
  • @MarkEvans That pretty much what I meant: brute-forcing the WAP key is usually not the easiest way in.
    – Stephane
    Oct 31, 2013 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.