Wi-Fi WPABasic Wireless Pentest Checklist

• If WPS is enabled try to brute-force the PIN
• WPS PIN cannot be changed

Airodump-ng

airodump-ng <interface> --wps

Reaver

https://github.com/t6x/reaver-wps-fork-t6x

• Wash is a tool included in the reaver suite.
• The output will show WPS if it is in use

wash -i <interface>

• If WPS is set to 2 it means WPS is not locked.

• An AP with a locked WPS state cannot be attacked

• Reaver can be used to brute-force the PIN

iw dev <interface> interface add mon0 type monitor
ifconfig mon0 up
reaver -i mon0 -c <channel> -b <BSSID MAC address>

Pixie Dust attack

• Targets Wi-Fi AP that use WPS with a weak or poorly implemented random nonce or predictable PIN generation.
• Instead of brute-forcing the 9-digit PIN, the WPS PIN is computed offline from caputured EAP messages.

Airgeddon

https://github.com/v1s1t0r1sh3r3/airgeddon

1. Select the Wi-Fi card
2. Put the Wi-Fi card into monitor mode
3. Select WPS attacks menu
4. Select Explore for targets
5. Choose the network from the range
6. Select Pixie Dust attack from the menu
7. Set the timeout period
8. Launch the attack
9. Watch the next screen which will say PIN FOUND if successful
10. Go back to the WPS attacks screen and select the (reaver) Custom PIN association item
11. Enter the PIN
12. Set the timeout period
13. Another menu will open and will show the PSK if successful

Mitigations

• Disable WPS on the AP
• Ensure the firmware is up to date to patch against pixie dust flaws
• Use WPA2/WPA3 enterprise
• Monitor and alert based on WPS session attempts

Detections

• Look for WPS enrollment attempts
• Look for frequent EAP/WPS sessions
• Use Wireless IDS signatures for WPS attacks