WPS PIN Brute-Force with Reaver

The WPS PIN brute-force attack exploits a design flaw in the WPS protocol where the AP validates the two halves of the 8-digit PIN independently. This reduces the effective search space from 100 million combinations to around 11,000. Reaver automates the PIN enumeration process and recovers the WPA2 passphrase directly from the AP once the correct PIN is found. No handshake capture or cracking is involved.

Confirm the target AP has WPS enabled and unlocked using wash before starting. See the WPS detection page.

WPS PIN Brute-Force with Reaver

-vv shows the full WPS exchange per attempt. Each PIN attempt takes between 3 and 10 seconds depending on the AP. Timing estimates for a full WPS PIN brute force with reaver:

• First half (10,000 PINs): 4 to 11 hours at 3-10 seconds per attempt.
• Second half (1,000 PINs): 15 to 45 minutes once the first half is known.
• Best case with no lockouts: roughly 4 hours total.
• With rate limiting and delays: can stretch to 24+ hours or stall entirely.

Pixie Dust vs Full Brute-Force

Before committing to a full brute-force, try the Pixie Dust attack first. Pixie Dust exploits weak random number generation in certain chipsets (Ralink, Broadcom, Realtek) to recover the PIN from a single WPS exchange in seconds:

Pixie Dust Attack with Reaver

-K enables Pixie Dust mode. If the AP is vulnerable, the PIN is recovered in under 30 seconds. If it fails with a timeout or "WPS pin not found" message, the chipset is not vulnerable and you need the full brute-force approach.

WPS Lockout Behavior

Most modern APs implement WPS lockout after repeated failed attempts. What you will see:

• After 3-10 failed PINs: the AP stops responding to WPS requests for 60-300 seconds.
• Some APs (Netgear, TP-Link) lock WPS permanently after ~10 failures until the AP is rebooted or the lock timer expires (often 5-10 minutes).
• Enterprise APs (Cisco, Aruba) may disable WPS entirely after a lockout event and log the attempt.
• Reaver detects lockouts and pauses automatically, but its detection is not perfect. If you see repeated "WARNING: Receive timeout" messages, the AP is likely locked.

Resume an Interrupted Session

Reaver saves progress automatically. To resume from where it stopped, run the same command again: it picks up from the last tested PIN automatically. To explicitly specify a starting PIN:

Handle Rate Limiting and Timeouts

Many APs introduce delays or temporary locks after failed WPS attempts. Add a delay between attempts to avoid triggering the lock:

-d 5 adds a 5-second delay between each attempt. -r 3:15 tells reaver to rest for 15 seconds after every 3 attempts. Tune these values based on how quickly the AP starts refusing attempts. If the AP locks, stop and wait for the lock to expire before continuing.

Specify the Channel Explicitly

If reaver is having trouble associating, specify the channel directly to avoid channel hopping issues:

Successful Recovery

When reaver finds the correct PIN it prints both the PIN and the recovered WPA passphrase:

The WPA PSK is the network passphrase in plaintext. Use it to connect to the network directly with nmcli or wpa_supplicant.