Questions tagged [wps]

WPS (Wi-Fi Protected Setup) is a protocol that attempts to allow easy establishment of a secure wireless home network.

Filter by
Sorted by
Tagged with
-5
votes
1answer
174 views

Has Wi-Fi hacking gotten almost impossible?

I have read about Wi-Fi password cracking for a while and used different tools my self, such as: Airodump for monitoring Aicrack for getting key from cap files for WEP/WPA/WPA2 Reaver for WPS Bully ...
1
vote
0answers
119 views

Bully and reaver not finding anything in any network

I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything. The command for reaver that I run is: reaver -i wlan0mon -c ...
1
vote
3answers
131 views

Does use of WEP only open the network to attacks in proximity of the router?

I'm learning about security, and discovered my family's router was set to use WEP, with WPS enabled. I've fixed that, but I couldn't give a great answer for why it was necessary, given that we live in ...
1
vote
0answers
555 views

Using Reaver in various UK routers results in stop after 90% progress

I've been trying to make use of the current wifi audition techniques in regards of Router Password retrieval. GEAR: I've been through car boot sales and acquired some of the current routers on the ...
1
vote
1answer
407 views

Speed up Reaver attack on router

I am trying to get the WPS pin by Reaver attack. The code I run is reaver -b (bssid) -c (channel) -i wlan0mon -vv It takes too much time guessing the WPS pin because it starts counting from 0000****...
4
votes
1answer
16k views

WPS cracking using reaver-bully on Kali Linux

My hardware looks like this : Lenovo Laptop running RHEL, and Virtual Machine Manager launching a VM with Kali Linux. Tried these network cards : TL-WN722N AWUS051NH AWUS036NH I am booting the VM ...
1
vote
1answer
3k views

How to continue where I left off on reaver?

I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far ...
1
vote
1answer
1k views

What does it mean when Reaver returns a PIN but no passphrase?

Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN. Any idea what it means when it's absent from the results? I also tried entering the PIN directly, using ...
4
votes
1answer
522 views

What additional steps can be taken on a wireless network penetration test after acquiring WPS pin?

I've been conducting some simple penetration tests on a few older wireless routers that I have lying around, focusing mainly on WPS vulnerabilities. I've been having some trouble with an old Belkin ...
0
votes
1answer
1k views

WPS Why Can't Pin be Bruteforced Offline

I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
12
votes
2answers
14k views

What is Pixie dust attack on router?

I read an article on this site, but didn't get what I wanted so my concerns are: How does pixie dust attack work? What is the flaw that only certain routers contain to being vulnerable for Pixie-Dust ...
1
vote
1answer
2k views

WPS. Output messaging translation to “human readable”

I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing... Reaver is "spitting" a lot of messages, the question is: What is ...
2
votes
1answer
2k views

WPS PBC Security

On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame. There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
1
vote
1answer
1k views

What should I do if my adapter isn't capable of packet injection?

I tried the aireplay test but it said "No Answers" instead of "Injection is working". I also get error of List of possible errors (which also includes packet injection problem) when trying to ...
2
votes
1answer
626 views

Is WPS still insecure if the router requires a client pin?

Recently purchased an Asus AC88U and I noticed that you can require a client pin for a WPS connection to successfully happen. It seems that this would be a pretty secure implementation of WPS. Are ...
5
votes
1answer
10k views

What's the difference between pixie attack and other attacks on WPS?

I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
4
votes
1answer
4k views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
3
votes
1answer
174 views

Why use WPS on an unsecured WiFi AP?

I was searching for my home WiFi AP (router's broken and am trying to fix it), when I found a WiFi access point that does not have any security but does have WPS enabled: Thinking that it probably ...
5
votes
1answer
396 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
2
votes
1answer
2k views

Dumpper and Jumpstart for hacking WPS

As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them. But with another tool called Jumpstart, together they can crack any AP that is running ...
2
votes
1answer
1k views

How to optimize cracking speed with Reaver

When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
2
votes
1answer
295 views

Is a “standalone WPS server” possible?

Wi-Fi Protected Setup (WPS) is a network security standard to create a secure wireless home network. It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button, ....
1
vote
1answer
735 views

Wi-Fi Protected Setup PIN method EAP Messages

Let's look at this example: router (access point) has 8-digit PIN (printed on label) and laptop wants to connect to network using WPS PIN. So user give router's PIN into laptop and laptop sends PIN to ...
4
votes
1answer
83 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from airodump-ng). I'm ...
8
votes
2answers
6k views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
0
votes
1answer
5k views

reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))

I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)). I ...
3
votes
1answer
558 views

Does WPS actually send passphrase?

As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established? If so, Why does it need to send PSK? I mean, if the session ...
2
votes
2answers
899 views

Enabled WPS methods

I would like to know if there are tools available to identify what WPS method is actually enabled on an AP? I would like to know also if there is a way by looking at packets to know which WPS method ...
14
votes
1answer
20k views

How does Dumpper program get default WPS without bruteforcing them?

Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below: How does this program work?
0
votes
1answer
233 views

WPS and WPA2 connection methods

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
5
votes
1answer
4k views

Why some routers ask for PIN but can't be cracked using PIN-based attacks?

I've been working with WPS assessment tools like Reaver and Bully for some time and i could successfully crack my router's PIN code and find its password on both QSS PBC and QSS PIN code. when each of ...
4
votes
2answers
5k views

How visible is a WPS attack with reaver?

I have been trying to find an answer to this but the search terms seem to be to ambiguous. I am attempting to determine from a strategic standpoint how intelligent it is to use reaver. From a ...
0
votes
2answers
9k views

How to make Reaver crack WPS faster [closed]

I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
5
votes
1answer
13k views

WPA/WPA2 attacks

How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
0
votes
1answer
3k views

Why is it not possible to capture a WPS handshake to WLAN

There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS ...
6
votes
2answers
382 views

Why was WPS not patched to make it secure?

A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits). However, since the flaw was discovered, why ...
1
vote
1answer
1k views

Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools?

I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities. What I am really unable to realize is why it ...
11
votes
3answers
10k views

What is the purpose of changing the default SSID?

Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
4
votes
1answer
3k views

WiFi Direct/WPS key question

So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection. Tools like Reaver ...
2
votes
2answers
1k views

Where does the WPS Pin fit into the 4-way-handshake?

So I found a diagram online, that shows the 4-way-handshake: The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication ...
2
votes
2answers
13k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices. Is that true?