Questions tagged [wps]
WPS (Wi-Fi Protected Setup) is a protocol that attempts to allow easy establishment of a secure wireless home network.
51
questions
2
votes
0
answers
67
views
Why would the WPS PIN be separated into two halves?
While preparing for the CompTIA Security+ certification, I learned that a problem with the 8-digit WPS PIN is that checking is split into two sets of 4-digits, and also that the last digit is a check ...
- 121
0
votes
0
answers
53
views
Are there some routers that have WPS, but without a fixed Pin?
My router only seems like to support the push button method, but I thought every router with wps has a fixed wps pin, or am I wrong?
- 616
0
votes
1
answer
364
views
WPS - How to get all valid pins?
There are 10⁷ elements in WPS pin space, because one of the 8 digits is used as the checksum.
But the AP validates each half separately, resulting in 11,000 valid pins. Is it possible to generate all ...
- 101
0
votes
2
answers
111
views
What type of attack does WPS prevent?
There are many talks about why someone should not use WPS because of the attacks it allows. But does it also prevent attacks? For example, if guests want to join my network instead of giving these ...
- 1
3
votes
1
answer
417
views
airgeddon returning the wrong key
I was testing how WPS works on my home router and tried to gain access with airgeddon.
Problem is the key that airgeddon returns is an 8-digit number, not my WPA2 password.
My output looks like this:
...
1
vote
1
answer
479
views
How do we know the AuthKey in Pixie Dust attack?
I've been reading about the Pixie Dust attack from various sources, that provide a low-level explanation of how it works.
In the values
E-Hash1 = HMAC(AuthKey, E-S1 || PSK1 || PKE || PKR)
and
E-...
2
votes
2
answers
644
views
How to know if my router has been hacked?
I have a (maybe dumb) question for you. I was wondering if there is a way to know if my router has been hacked.
I secured it the best that I can and also made it so only the mac addresses of the ...
- 21
1
vote
1
answer
3k
views
Success rate of pixie dust attack
Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS-enabled ...
- 51
1
vote
0
answers
3k
views
Problem while using Reaver WPS
I was trying to crack my WiFi Router. I have two laptops an older one(Lenevo 3000 G430) and a newer one(HP Elitebook 840 G3) with their internal adapter. The old one has BCM4312 802.11b/g
chipset and ...
- 11
1
vote
0
answers
857
views
Display filter to see WPS attempts in WireShark [closed]
My neighbour is actively trying WPS pins on my router - I know because the "WiFi/WPS" LED on my router lit up when I have permanently turned it off! I double checked the setting using the router admin ...
- 121
-5
votes
1
answer
2k
views
Has Wi-Fi hacking gotten almost impossible?
I have read about Wi-Fi password cracking for a while and used different tools my self, such as:
Airodump for monitoring
Aicrack for getting key from cap files for WEP/WPA/WPA2
Reaver for WPS
Bully ...
- 1
1
vote
0
answers
2k
views
Bully and reaver not finding anything in any network
I have been trying out reaver and bully on my network and friends network, multiple different routers, but none of them finds anything.
The command for reaver that I run is:
reaver -i wlan0mon -c ...
- 11
1
vote
3
answers
269
views
Does use of WEP only open the network to attacks in proximity of the router?
I'm learning about security, and discovered my family's router was set to use WEP, with WPS enabled. I've fixed that, but I couldn't give a great answer for why it was necessary, given that we live in ...
- 113
1
vote
0
answers
918
views
Using Reaver in various UK routers results in stop after 90% progress
I've been trying to make use of the current wifi audition techniques in regards of Router Password retrieval.
GEAR:
I've been through car boot sales and acquired some of the current routers on the ...
- 11
1
vote
1
answer
642
views
Speed up Reaver attack on router
I am trying to get the WPS pin by Reaver attack.
The code I run is
reaver -b (bssid) -c (channel) -i wlan0mon -vv
It takes too much time guessing the WPS pin because it starts counting from 0000****...
4
votes
1
answer
24k
views
WPS cracking using reaver-bully on Kali Linux
My hardware looks like this :
Lenovo Laptop running RHEL, and Virtual Machine Manager launching a VM with Kali Linux.
Tried these network cards :
TL-WN722N
AWUS051NH
AWUS036NH
I am booting the VM ...
- 141
2
votes
1
answer
5k
views
How to continue where I left off on reaver?
I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far ...
- 705
1
vote
1
answer
2k
views
What does it mean when Reaver returns a PIN but no passphrase?
Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN.
Any idea what it means when it's absent from the results?
I also tried entering the PIN directly, using ...
- 1,709
4
votes
1
answer
705
views
What additional steps can be taken on a wireless network penetration test after acquiring WPS pin?
I've been conducting some simple penetration tests on a few older wireless routers that I have lying around, focusing mainly on WPS vulnerabilities. I've been having some trouble with an old Belkin ...
- 181
0
votes
1
answer
3k
views
WPS Why Can't Pin be Bruteforced Offline
I don't totally understand how the WPS protocol works but why cannot a user get the hash of the WPS pin from the router and crack it in the same way a WPA2 handshake is cracked? (Not pixiewps but ...
- 503
14
votes
2
answers
51k
views
What is Pixie dust attack on router?
I read an article on this site,
but didn't get what I wanted so my concerns are:
How does pixie dust attack work?
What is the flaw that only certain routers contain to being vulnerable for Pixie-Dust ...
- 241
1
vote
1
answer
3k
views
WPS. Output messaging translation to "human readable"
I'm trying to test the wifi security of my router at home. It has WPS activated. I know WPS should deactivated, I'm only testing...
Reaver is "spitting" a lot of messages, the question is:
What is ...
- 91
2
votes
1
answer
3k
views
WPS PBC Security
On my router I have a WPS button (PBC) that enables anyone to connect during a short time frame.
There is no 4 numbers PIN anywhere on the router or on the instruction manual, and I can't find any ...
- 1,941
1
vote
2
answers
5k
views
What should I do if my adapter isn't capable of packet injection?
I tried the aireplay test but it said "No Answers" instead of "Injection is working". I also get error of List of possible errors (which also includes packet injection problem) when trying to ...
- 171
2
votes
1
answer
761
views
Is WPS still insecure if the router requires a client pin?
Recently purchased an Asus AC88U and I noticed that you can require a client pin for a WPS connection to successfully happen. It seems that this would be a pretty secure implementation of WPS.
Are ...
- 123
6
votes
1
answer
12k
views
What's the difference between pixie attack and other attacks on WPS?
I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and that the PIN is divided into two halves in M4 and M6 messages, ...
- 473
4
votes
1
answer
5k
views
Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?
I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
- 473
3
votes
1
answer
261
views
Why use WPS on an unsecured WiFi AP?
I was searching for my home WiFi AP (router's broken and am trying to fix it), when I found a WiFi access point that does not have any security but does have WPS enabled:
Thinking that it probably ...
- 777
5
votes
1
answer
516
views
What about Long Router Passwords and WPS Push-Buttons
I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
- 371
2
votes
1
answer
4k
views
Dumpper and Jumpstart for hacking WPS
As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them.
But with another tool called Jumpstart, together they can crack any AP that is running ...
- 2,495
2
votes
1
answer
2k
views
How to optimize cracking speed with Reaver
When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
- 141
2
votes
1
answer
400
views
Is a "standalone WPS server" possible?
Wi-Fi Protected Setup (WPS) is
a network security standard to create a secure wireless home network.
It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button, ....
- 8,968
1
vote
1
answer
1k
views
Wi-Fi Protected Setup PIN method EAP Messages
Let's look at this example: router (access point) has 8-digit PIN (printed on label) and laptop wants to connect to network using WPS PIN. So user give router's PIN into laptop and laptop sends PIN to ...
4
votes
1
answer
150
views
Reaver stuck at flow_handler
I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from airodump-ng).
I'm ...
- 151
13
votes
3
answers
9k
views
If WPA2-PSK is insecure, what other options do home users have?
from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
- 233
1
vote
1
answer
6k
views
reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))
I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)).
I ...
- 11
3
votes
1
answer
867
views
Does WPS actually send passphrase?
As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established?
If so, Why does it need to send PSK? I mean, if the session ...
- 31
2
votes
2
answers
1k
views
Enabled WPS methods
I would like to know if there are tools available to identify what WPS method is actually enabled on an AP?
I would like to know also if there is a way by looking at packets to know which WPS method ...
- 577
14
votes
1
answer
20k
views
How does Dumpper program get default WPS without bruteforcing them?
Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below:
How does this program work?
- 867
0
votes
1
answer
298
views
WPS and WPA2 connection methods
Do clients use WPS every time when they connect to a WPS-enabled AP?
Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange?
If the latter, it's possible for ...
5
votes
1
answer
5k
views
Why some routers ask for PIN but can't be cracked using PIN-based attacks?
I've been working with WPS assessment tools like Reaver and Bully for some time and i could successfully crack my router's PIN code and find its password on both QSS PBC and QSS PIN code. when each of ...
user60980
4
votes
2
answers
6k
views
How visible is a WPS attack with reaver?
I have been trying to find an answer to this but the search terms seem to be to ambiguous.
I am attempting to determine from a strategic standpoint how intelligent it is to use reaver.
From a ...
- 1,451
0
votes
2
answers
10k
views
How to make Reaver crack WPS faster [closed]
I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
- 111
6
votes
1
answer
14k
views
WPA/WPA2 attacks
How does someone attack a WPA/WPA2 wireless network? I have read on the two main approaches: dictionary and rainbow tables. How do you use rainbow tables in conjunction with your tool of choice? I ...
- 61
1
vote
1
answer
3k
views
Why is it not possible to capture a WPS handshake to WLAN
There are well known attacks to WPA by capturing handshake and running offline hashcracking against it. Also there are tools to exploit vulnerability in WPS to get the PIN. My question is why WPS ...
- 75
6
votes
2
answers
557
views
Why was WPS not patched to make it secure?
A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits).
However, since the flaw was discovered, why ...
- 1,881
1
vote
1
answer
2k
views
Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools?
I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities.
What I am really unable to realize is why it ...
- 61
15
votes
3
answers
13k
views
What is the purpose of changing the default SSID?
Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
- 285
4
votes
1
answer
4k
views
WiFi Direct/WPS key question
So far, I haven't seen any PoC or real-world attacks against WiFi Direct, but I see the potential because it relies on WiFi Protected Setup (WPS) for establishing the connection.
Tools like Reaver ...
- 43
2
votes
2
answers
2k
views
Where does the WPS Pin fit into the 4-way-handshake?
So I found a diagram online, that shows the 4-way-handshake:
The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication ...
- 267