WPS

Overview

WPS (Wi-Fi Protected Setup) simplifies connecting to a network without entering a passphrase. Two methods exist: Push Button Configuration (PBC) and PIN entry.

Push Button (PBC)

Physical button on router triggers a 2-minute association window. 1. Start wpa_supplicant:

sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -B

2. Trigger PBC:

sudo wpa_cli -i wlan0 wps_pbc

Press the WPS button on the router within 2 minutes. 3. Get IP:

sudo dhclient wlan0 -v

PIN Method

1. Start wpa_supplicant:

sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -B

2. Get BSSID of target:

sudo wpa_cli -i wlan0 scan
sudo wpa_cli -i wlan0 scan_results

3. Connect with PIN:

sudo wpa_cli -i wlan0 wps_pin <BSSID> <8-DIGIT-PIN>

Leave PIN blank to generate one automatically:

sudo wpa_cli -i wlan0 wps_pin <BSSID> any

4. Get IP:

sudo dhclient wlan0 -v

wpa_supplicant Base Config

Minimal config file needed to run wpa_supplicant:

ctrl_interface=/run/wpa_supplicant
update_config=1

Save as /etc/wpa_supplicant/wpa_supplicant.conf.

WPS PIN method requires the router to have the Registrar role. Some routers disable PIN after repeated failures (lockout protection).

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Push Button (PBC)

PIN Method

wpa_supplicant Base Config

​Overview

​Push Button (PBC)

​PIN Method

​wpa_supplicant Base Config

Overview

Push Button (PBC)

PIN Method

wpa_supplicant Base Config