reaver1

Wps cracker

Usage

reaver -i <interface> -b <target bssid> -vv

Overview

Reaver implements a brute force attack against WiFi Protected Setup which can crack the WPS pin of an access point in a matter of hours and subsequently recover the WPA/WPA2 passphrase.

Specifically, Reaver targets the registrar functionality of WPS, which is flawed in that it only takes 11,000 attempts to guess the correct WPS pin in order to become a WPS registrar. Once registred as a registrar with the access point, the access point will give you the WPA passphrase.

Options

-m, --mac=<mac>: MAC of the host system (should be resolved automatically)

-e, --essid=<ssid>: ESSID of the target AP. Unless cloaked, this will be resolved automatically.

-c, --channel=<channel>: Set the 802.11 channel for the interface (implies -f)

-o, --out-file=<file>: Send output to a log file [default: stdout]

-f, --fixed: Disable channel hopping

-5, --5ghz: Use 5GHz 802.11 channels

-v, --verbose: Display non-critical warnings (-vv for more)

-q, --quiet: Only display critical messages

-i, --interface=<wlan>: Name of the monitor-mode interface to use

-b, --bssid=<mac>: BSSID of the target AP

-p, --pin=<wps pin>

Use the specified WPS pin

-h, --help: Show help

Releases

Unchanged in 8 releases since Debian 7 (Wheezy).

7–Arch