Questions tagged [wps]
WPS (Wi-Fi Protected Setup) is a protocol that attempts to allow easy establishment of a secure wireless home network.
47
questions
1
vote
1answer
115 views
WPS PIN and key
I was testing how WPS works on my home router and tried to gain access with a tool I found on github called airgeddon.
Problem is, I got the PIN down (the PIN I wrote down below is made up, it's ...
1
vote
1answer
169 views
How do we know the AuthKey in Pixie Dust attack?
I've been reading about the Pixie Dust attack from various sources, that provide a low-level explanation of how it works.
In the values
E-Hash1 = HMAC(AuthKey, E-S1 || PSK1 || PKE || PKR)
and
E-...
1
vote
2answers
400 views
How to know if my router has been hacked?
I have a (maybe dumb) question for you. I was wondering if there is a way to know if my router has been hacked.
I secured it the best that I can and also made it so only the mac addresses of the ...
1
vote
1answer
1k views
Success rate of pixie dust attack
Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS enabled ...
1
vote
0answers
2k views
Problem while using Reaver WPS
I was trying to crack my WiFi Router. I have two laptops an older one(Lenevo 3000 G430) and a newer one(HP Elitebook 840 G3) with their internal adapter. The old one has BCM4312 802.11b/g
chipset and ...
1
vote
0answers
436 views
Display filter to see WPS attempts in WireShark [closed]
My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin ...
-5
votes
1answer
1k views
Has Wi-Fi hacking gotten almost impossible?
I have read about Wi-Fi password cracking for a while and used different tools my self, such as:
Airodump for monitoring
Aicrack for getting key from cap files for WEP/WPA/WPA2
Reaver for WPS
Bully ...
1
vote
0answers
1k views
Bully and reaver not finding anything in any network
I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything.
The command for reaver that I run is:
reaver -i wlan0mon -c ...
1
vote
3answers
174 views
Does use of WEP only open the network to attacks in proximity of the router?
I'm learning about security, and discovered my family's router was set to use WEP, with WPS enabled. I've fixed that, but I couldn't give a great answer for why it was necessary, given that we live in ...
1
vote
0answers
769 views
Using Reaver in various UK routers results in stop after 90% progress
I've been trying to make use of the current wifi audition techniques in regards of Router Password retrieval.
GEAR:
I've been through car boot sales and acquired some of the current routers on the ...
1
vote
1answer
512 views
Speed up Reaver attack on router
I am trying to get the WPS pin by Reaver attack.
The code I run is
reaver -b (bssid) -c (channel) -i wlan0mon -vv
It takes too much time guessing the WPS pin because it starts counting from 0000****...
4
votes
1answer
22k views
WPS cracking using reaver-bully on Kali Linux
My hardware looks like this :
Lenovo Laptop running RHEL, and Virtual Machine Manager launching a VM with Kali Linux.
Tried these network cards :
TL-WN722N
AWUS051NH
AWUS036NH
I am booting the VM ...
2
votes
1answer
5k views
How to continue where I left off on reaver?
I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far ...
1
vote
1answer
2k views
What does it mean when Reaver returns a PIN but no passphrase?
Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN.
Any idea what it means when it's absent from the results?
I also tried entering the PIN directly, using ...
4
votes
1answer
617 views
What additional steps can be taken on a wireless network penetration test after acquiring WPS pin?
I've been conducting some simple penetration tests on a few older wireless routers that I have lying around, focusing mainly on WPS vulnerabilities. I've been having some trouble with an old Belkin ...
0
votes
1answer
2k views
WPS Why Can't Pin be Bruteforced Offline
I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
13
votes
2answers
35k views
What is Pixie dust attack on router?
I read an article on this site,
but didn't get what I wanted so my concerns are:
How does pixie dust attack work?
What is the flaw that only certain routers contain to being vulnerable for Pixie-Dust ...
1
vote
1answer
2k views
WPS. Output messaging translation to “human readable”
I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing...
Reaver is "spitting" a lot of messages, the question is:
What is ...
2
votes
1answer
2k views
WPS PBC Security
On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame.
There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
1
vote
1answer
3k views
What should I do if my adapter isn't capable of packet injection?
I tried the aireplay test but it said "No Answers" instead of "Injection is working". I also get error of List of possible errors (which also includes packet injection problem) when trying to ...
2
votes
1answer
689 views
Is WPS still insecure if the router requires a client pin?
Recently purchased an Asus AC88U and I noticed that you can require a client pin for a WPS connection to successfully happen. It seems that this would be a pretty secure implementation of WPS.
Are ...
6
votes
1answer
12k views
What's the difference between pixie attack and other attacks on WPS?
I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
4
votes
1answer
5k views
Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?
I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
3
votes
1answer
212 views
Why use WPS on an unsecured WiFi AP?
I was searching for my home WiFi AP (router's broken and am trying to fix it), when I found a WiFi access point that does not have any security but does have WPS enabled:
Thinking that it probably ...
5
votes
1answer
458 views
What about Long Router Passwords and WPS Push-Buttons
I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
2
votes
1answer
3k views
Dumpper and Jumpstart for hacking WPS
As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them.
But with another tool called Jumpstart, together they can crack any AP that is running ...
2
votes
1answer
1k views
How to optimize cracking speed with Reaver
When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
2
votes
1answer
350 views
Is a “standalone WPS server” possible?
Wi-Fi Protected Setup (WPS) is
a network security standard to create a secure wireless home network.
It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button, ....
1
vote
1answer
966 views
Wi-Fi Protected Setup PIN method EAP Messages
Let's look at this example: router (access point) has 8-digit PIN (printed on label) and laptop wants to connect to network using WPS PIN. So user give router's PIN into laptop and laptop sends PIN to ...
4
votes
1answer
95 views
Reaver stuck at flow_handler
I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from airodump-ng).
I'm ...
11
votes
3answers
7k views
If WPA2-PSK is insecure, what other options do home users have?
from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
1
vote
1answer
6k views
reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))
I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)).
I ...
3
votes
1answer
668 views
Does WPS actually send passphrase?
As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established?
If so, Why does it need to send PSK? I mean, if the session ...
2
votes
2answers
1k views
Enabled WPS methods
I would like to know if there are tools available to identify what WPS method is actually enabled on an AP?
I would like to know also if there is a way by looking at packets to know which WPS method ...
14
votes
1answer
20k views
How does Dumpper program get default WPS without bruteforcing them?
Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below:
How does this program work?
0
votes
1answer
244 views
WPS and WPA2 connection methods
Do clients use WPS every time when they connect to a WPS-enabled AP?
Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange?
If the latter, it's possible for ...
5
votes
1answer
4k views
Why some routers ask for PIN but can't be cracked using PIN-based attacks?
I've been working with WPS assessment tools like Reaver and Bully for some time and i could successfully crack my router's PIN code and find its password on both QSS PBC and QSS PIN code. when each of ...
4
votes
2answers
6k views
How visible is a WPS attack with reaver?
I have been trying to find an answer to this but the search terms seem to be to ambiguous.
I am attempting to determine from a strategic standpoint how intelligent it is to use reaver.
From a ...
0
votes
2answers
10k views
How to make Reaver crack WPS faster [closed]
I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
5
votes
1answer
13k views
WPA/WPA2 attacks
How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
1
vote
1answer
3k views
Why is it not possible to capture a WPS handshake to WLAN
There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS ...
6
votes
2answers
466 views
Why was WPS not patched to make it secure?
A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits).
However, since the flaw was discovered, why ...
1
vote
1answer
2k views
Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools?
I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities.
What I am really unable to realize is why it ...
15
votes
3answers
13k views
What is the purpose of changing the default SSID?
Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
4
votes
1answer
4k views
WiFi Direct/WPS key question
So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection.
Tools like Reaver ...
2
votes
2answers
2k views
Where does the WPS Pin fit into the 4-way-handshake?
So I found a diagram online, that shows the 4-way-handshake:
The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication ...
2
votes
2answers
13k views
Has the WPS brute-force cracking issue been fixed?
I have heard a rumor that the WPS brute force attack doesn't work on newer devices. Is that true?
