11 votes
Accepted

What is Pixie dust attack on router?

A Pixie-Dust attack works by bruteforcing the key for a protocol called WPS. WPS was intended to make accessing a router easier, and it did - for attackers. A WPS Pin consists of 8 digits - two Pre-...
thel3l's user avatar
  • 3,414
9 votes
Accepted

What's the difference between pixie attack and other attacks on WPS?

Pixie works by exploiting weaknesses in the generation of the E-S1 and E-S2 nonces which are used to produce the enrollee hash, as described in the Pixie Dust Attack. Traditional attacks attack the ...
Polynomial's user avatar
  • 135k
6 votes

WPS cracking using reaver-bully on Kali Linux

I have a couple of recommendations for you. First of all. If I'm not wrong, both of your Alfa's are Ralink chipset based. You must know that Ralink chipsets and reaver have an awful results. It's ...
OscarAkaElvis's user avatar
5 votes
Accepted

Dumpper and Jumpstart for hacking WPS

As the other question's answer said, Dumpper looks like it identifies the AP via its MAC address or other information exposed over the 802.11 protocol, then checks a database to work out if the ...
Polynomial's user avatar
  • 135k
4 votes
Accepted

Why use WPS on an unsecured WiFi AP?

You've hit it pretty hard on the head of the nail here and driven it home. It doesn't make sense. This really only matters if some sort of other filter is in place to prevent connection, and it wasn't ...
Robert Mennell's user avatar
4 votes

Has Wi-Fi hacking gotten almost impossible?

Having a dictionary password is a norm, not an exception. As for countries other than US, the attacker would simply use password dictionaries for the appropriate locations. Also don’t take term “...
Andrew Morozko's user avatar
4 votes

What is Pixie dust attack on router?

One of his books, Kevin D. Mitnick writes about Pixie Dust Attack: To make connecting any new device to a home router easy, the Wi-Fi Alliance, a group of vendors eager to spread the use of Wi-Fi ...
cyberbird's user avatar
  • 127
3 votes
Accepted

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

This is happening because your AP is able to filter out the MAC address and block it after an x amount of requests. What you need to do is to change the MAC address every x requests so the router won'...
Bubble Hacker's user avatar
2 votes

Reaver stuck at flow_handler

There's much to be done before you can get a correct answer for this situation. First, and most simple solution, you can check your AP manufacture website to be sure if it's immune to WPS PIN ...
Eibo's user avatar
  • 2,495
2 votes

If WPA2-PSK is insecure, what other options do home users have?

I know that there is a vulnerability with WPS, even when using WPA2, but aside from that is WPA2-PSK really secure? Define secure. In the general sense, if you have WPS disabled, are using a long PSK ...
YLearn's user avatar
  • 3,997
2 votes

What should I do if my adapter isn't capable of packet injection?

Have you read the aircrack article about supported cards? Start there to begin with. They even have a tool to test if your cards supports monitor/injection mode. If the hardware doesn't support modes ...
Yorick de Wid's user avatar
2 votes
Accepted

Is WPS still insecure if the router requires a client pin?

The problem is not what the PIN is or how it was set, but how fast it can be cracked. Often this is a matter of hours. The WPS PIN consist of two part, or 8 bytes. The last digit counts as an checksum,...
Yorick de Wid's user avatar
2 votes

WPS PBC Security

The best method is to try I think. Scan your network with wash... or even better using airodump-ng with the --wps parameter . This parameter is availabe since 1.2 rc2 version I think (not sure). If ...
OscarAkaElvis's user avatar
2 votes
Accepted

Does use of WEP only open the network to attacks in proximity of the router?

Does use of WEP only open the network to attacks in proximity of the router? Yes. WEP is used for protecting the wireless communication between a device and your router. So the insecurity of WEP is ...
YLearn's user avatar
  • 3,997
2 votes

Does use of WEP only open the network to attacks in proximity of the router?

It is true that the attacker needs to get his radio in range of your network. However By using a directional antenna the attacker may be able to significantly increase the radio range. Remember it'...
Peter Green's user avatar
  • 5,300
2 votes

Does use of WEP only open the network to attacks in proximity of the router?

Always remember the OSI model. WiFi signal and encryption exist on the lower levels of the model, which by necessity means that the attacks that it mitigates, and the possible attacks against it, also ...
schroeder's user avatar
  • 129k
2 votes
Accepted

How to continue where I left off on reaver?

You require the reaver session file for this. I'm assuming you are working on a Linux system (Kali probably), the session file is saved in /usr/local/etc/reaver and named <BSSID>.wpc. Look for ...
whoami's user avatar
  • 1,366
2 votes

How to know if my router has been hacked?

There is a good chance that your router itself has not been hacked. By default, ISP routers usually heavily restrict inbound connections from the Internet. but I keep seeing accesses to my social ...
ghrs's user avatar
  • 71
1 vote

What type of attack does WPS prevent?

WPS is not meant to prevent attacks. It is meant to make it easy to add new devices to the network securely. In short, the "protection" it provides is to make it so that the WiFi owner doesn'...
schroeder's user avatar
  • 129k
1 vote
Accepted

How do we know the AuthKey in Pixie Dust attack?

The AuthKey is known as such: When the registrar receives M1 he generates his public key and rnonce and can compute the DHKey = SHA-256(gAB mod p, 192) and subsequently the KDK = HMAC-SHA-256(...
Giannis Pappas's user avatar
1 vote

What does it mean when Reaver returns a PIN but no passphrase?

This usually happens if the router has the PBC (Push Button Connect) activated. The wps pin is the correct but then you can't get the password. So you'll need to push physically the button on router. ...
OscarAkaElvis's user avatar
1 vote

What additional steps can be taken on a wireless network penetration test after acquiring WPS pin?

You can check with other wireless device using different chipset. Sometimes (is weird I know) with other device it works. Sometimes, there is some kind of incompatibility between the software and the ...
OscarAkaElvis's user avatar
1 vote
Accepted

WPS Why Can't Pin be Bruteforced Offline

The hash of the WPS PIN doesn't leave the router. It is stored on the router. Client and router perform a Diffie-Hellman key exchange and then use hashes of the PIN and the exchanged keys to prove to ...
Philipp's user avatar
  • 49.4k
1 vote
Accepted

WPS. Output messaging translation to "human readable"

A very short answer could be: [+] Waiting for beacon from XX:XX:XX:... -> searching for Access Point [+] Associated with XX:XX:XX:... (ESSID: WifiTesting) -> Connected by radio [+] Trying pin ...
OscarAkaElvis's user avatar
1 vote

What should I do if my adapter isn't capable of packet injection?

Had the same issue but I realized my device was under monitor mode and needed to be under managed mode, here are the steps for both: Setting up the card in monitor mode #Set interface down sudo ip ...
RodDev's user avatar
  • 11
1 vote

What about Long Router Passwords and WPS Push-Buttons

The short answer is your setup is relatively secure. The longer answer is there will still be vulnerabilities like devices being able to join a few minutes after the WPS push button is pushed. OR any ...
John's user avatar
  • 151
1 vote
Accepted

How to optimize cracking speed with Reaver

The WPS PIN vulnerability is an online brute-force attack: you make a guess at the PIN, and the router tells you if it's correct or not. Because of this, the limiting factor for attack speed is how ...
Mark's user avatar
  • 34.6k
1 vote

Is a "standalone WPS server" possible?

You got this right. WPS is just a way to provide the data needed to access the AP over WPA2. Why WPS is insecure WPS itself is insecure. This is because the PIN which is 8 digits long is split up in ...
davidb's user avatar
  • 4,313
1 vote

reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))

To associate to an AP with reaver you must have a good signal. That's the first important point. And sometimes depending of your Chipset could not be possible. For example, if you have (like me) an ...
OscarAkaElvis's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible