Working Of WPS
- The 8th digit is a checksum of first 7 digits. 10^7 possibilities, i.e. one-tenth time. Two months, still a way to go.
- The pin number for verification goes in two halves, so we can independently verify the first four and the last four digits. And believe me, its easy to guess 4 digits correct two times, than to guess 8 correct digits at once. Basically, the first half would take 10^4 guess and the second would take 10^3.
How to carry out the attack
reaver -i <interface-name> -b <BSSID of target>
And if you are already familiar with hacking WEP, then just go to your Kali Linux terminal and type the above command (replacing what needs to be replaced). Leave your machine as is, come back 10 mins later, check the progress (must be 1% or something), and go take a nap. However, if you’re a newbie, then tag along.
- Does it have WPS enabled. If not, then the attack will not work.
- The BSSID of the network.
- Set your wireless interface in monitor mode-
airmon-ng start wlan0
- Use wash (easy but sometimes unable to detect networks even when they have wps enabled). If any network shows up there, it has WPS enabled.
wash -i mon0
|This will show all the networks with WPS enabled|
|This is an error which I haven’t figured out yet. If you see it, then you’ll have to do some howework, or move on to airodump method. Update : wash -i mon0 –ignore-fcs might solves the issue.|
- Use airodump-ng. It will show all networks around you. It tells which of them use WPA. You’ll have to assume they have WPS, and then move to next steps.
|None of them has WPS enabled, just saying.|
BSSID of the network – Now irrespective of what you used, you should have a BSSID column in the result that you get. Copy the BSSID of the network you want to hack. That’s all the information you need.
So by now you must have something like XX:XX:XX:XX:XX:XX, which is the BSSID of your target network. Keep this copied, as you’ll need it.
Now finally we are going to use Reaver to get the password of the WPA/WPA2 network. Reaver makes hacking very easy, and all you need to do is enter-
reaver -i mon0 -b XX:XX:XX:XX:XX:XX
Explanation = i – interface used. Remember creating a monitor interface mon0 using airmon-ng start wlan0. This is what we are using. -b species the BSSID of the network that we found out earlier.
This is all the information that Reaver need to get started. However, Reaver comes with many advanced options, and some are recommended by me. Most importantly, you should use the -vv option, which increases the verbosity of the tool. Basically, it writes everything thats going on to the terminal. This helps you see whats happening, track the progress, and if needed, do some troubleshooting. So final command should be-
reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv
After some hours, you will see something like this. The pin in this case was intentionally 12345670, so it was hacked in 3 seconds.
Here is an extra section, which might prove useful (or more like consoling, to let you know you are not the only one who is having troubles)
Known problems that are faced – Troubleshooting
- As in the pic above, you saw the first line read “Switching wlan0 to channel 6”. (Yours will be mon0 instead of wlan0). Sometimes, it keeps switching interfaces forever.
- Sometimes it never gets a beacon frame, and gets stuck in the waiting for beacon frame stage.
- Sometimes it never associates with the target AP.
- Sometimes the response is too slow, or never comes, and a (0x02) or something error is displayed.
- Something wrong with wireless card.
- AP is very choosy, won’t let you associate.
- The AP does not use WPS.
- You are very far from the AP.
- Sometimes, killing naughty processes helps. (see pictures below)
- Move closer to target AP
- Do a fakeauth using aireplay-ng and tell Reaver not to bother as we are already associated using -A (just add -A at the end of your normal reaver code)
- If you are using Kali Linux in Vmware, try booting into Kali using USB. I don’t know why, but sometimes internal adapters work wonders, and can’t be used from inside of a VM. In my case, booting up from USB and using internal adapter increased the signal strength and speeded up the bruteforce process. Update : It has nothing to do with internal adapter. I have verified my observation with various hackers, and it is now a known problem with Reaver. It does not work well inside Virtual machines. It is recommended that you do a live boot.
|processes causing problems|
|Kill ’em all|