Cracking WPS
WPS stands for Wi-Fi Protected Setup. This was introduced in 2006 and the main of was to ease the process of adding new devices to the network; there was no need to remember long WPA or WEP passphrases. However, the security of WPS was short-lived; in 2011 a major security flaw was revealed that affected wireless routers that supported WPS.
Getting ready
For this recipe, we are going to use a tool called Reaver. It is an open source WPS cracking tool preinstalled in Linux. Reaver performs a brute force attack on the WPS pin number. Once we get the WPS PIN, the WPA PSK is recovered. For this exercise we will require a wireless router that has the WPS feature enabled.
How to do it...
- To scan for WPS enabled routers there is a package that comes with Reaver called
wash
; enter the following command to list the WPS-enabled device. Note that monitor mode is required to see the Beacon packets, understand whether the AP supports WPS, and tell whether WPS access is locked. This helps...