WPS
Enum:
airodump-ng
Wash
Version 2 mandated mitigations to prevent brute forcing, which may just slow down a bruteforce attack. The Lck indicates if WPS is locked, meaning an attack is pointless at this time.
Wash scans the 2.4GHz band by default. To make it scan 5GHz, we can append the -5 option to the command.
Attack:
Reaver:
add the channel parameter (-c) followed by the channel.
Bully:
Once the PIN is recovered, we can provide it to bully to do a single PIN try, using -B -p followed by the PIN, to recover the passphrase.
Both reaver and bully can verify a single pin, and in order to use an empty PIN, we will use -p ''
Airegeddon:
install:
We'll use source to execute a shell script, known_pins.db, which loads an array of PINs into memory. Finally, we'll check the database for an AP whose BSSID starts with "0013F7". It is case sensitive and the first three bytes must be uppercase.
Potential issues:
restart if:
WPS Lock
We can use authentication DoS, EAPOL Start DoS, or the EAPOL Logoff flood attack. We may need multiple wireless cards to carry out the attack, overflow the AP, and make it crash so that it reboots.
Last updated