OSWP · Module 10

Attacking WPS Networks

Discover WPS-enabled APs and recover the PIN (and WPA PSK) via Pixie Dust and online brute force, handling WPS lockouts.

~1.5 h 5 resources Last updated September 27, 2026

Wi-Fi Protected Setup (WPS) was meant to simplify connecting devices, but its 8-digit PIN is a serious weakness: the PIN is validated in two halves and the last digit is a checksum, collapsing the keyspace and enabling both online brute force and the offline Pixie Dust attack. PEN-210 covers discovering WPS-enabled networks, recovering the PIN (and therefore the WPA PSK), and dealing with the lockouts APs use to defend themselves.

WPS Discovery

Before attacking, confirm WPS is enabled and not locked. wash lists WPS-capable APs, their WPS version, and lock state, and can read WPS state from an existing capture. Confirming clients and the AP's WPS configuration up front tells you whether Pixie Dust or a full PIN brute force is worth attempting.

WPS PIN Attacks

Pixie Dust exploits weak randomness in the AP's WPS implementation to recover the PIN offline in seconds, using reaver, bully, or pixiewps directly. When Pixie Dust fails, reaver runs a full online PIN brute force, resumable across sessions and tunable around rate limiting. A recovered PIN yields the WPA PSK directly.

WPS Interference and Lockouts

APs lock WPS after repeated failures. mdk3 can flood deauthentication or beacons to disrupt clients and, in some cases, help overcome or reset WPS lockout behavior, keeping a brute force viable against a defended AP.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Mark WPS Network Discovery with wash as done

Guide 3 min read
WPS Network Discovery with wash
Focus on #WPS Network Discovery with wash #Ignore Locked APs #Scan on a Specific Channel #Scan from an Existing Capture File #Bypass FCS Errors
Mark Detecting WPS Vulnerable Networks as done

Guide 3 min read
Detecting WPS Vulnerable Networks
Focus on #Detect WPS Vulnerable Networks with wash #Handle FCS Errors #Confirm WPS from an Existing Capture #Confirm WPS State with iw
Mark WPS Pixie Dust Attack with Reaver and Pixiewps as done

Guide 3 min read
WPS Pixie Dust Attack with Reaver and Pixiewps
Focus on #WPS Pixie Dust Attack with Reaver #Run Pixie Dust with bully #Run pixiewps Manually #Handle Association Failures
Mark WPS PIN Brute-Force with Reaver as done

Guide 4 min read
WPS PIN Brute-Force with Reaver
Focus on #WPS PIN Brute-Force with Reaver #Pixie Dust vs Full Brute-Force #WPS Lockout Behavior #Resume an Interrupted Session #Handle Rate Limiting and Timeouts #Specify the Channel Explicitly
Mark WPS Interference and Beacon Flooding with mdk3 as done

Guide 3 min read
WPS Interference and Beacon Flooding with mdk3
Focus on #Install mdk3 #mdk3 Wireless Interference via Deauthentication Flood #Deauthenticate Using a Blacklist File #Beacon Flood to Confuse Clients #Overcome WPS Lockouts #Authentication Denial Against a Specific AP