Skip to content
HackIndex logo

HackIndex

WPS Network Discovery with wash

2 min read Mar 17, 2026

WPS (Wi-Fi Protected Setup) is a feature that allows devices to join a network without entering the full passphrase. It uses an 8-digit PIN that is vulnerable to brute-force due to a design flaw that allows it to be attacked in two halves, reducing the search space significantly. Some implementations are also vulnerable to the Pixie Dust attack, which recovers the PIN offline from a single exchange.

wash identifies which access points have WPS enabled and whether the WPS implementation is currently locked after failed attempts. Monitor mode must be active before running wash.

Scan for WPS-Enabled Networks

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon 
BSSID               Ch  dBm  WPS  Lck  Vendor    ESSID
--------------------------------------------------------------------------------
AA:BB:CC:DD:EE:FF    6  -54  2.0  No   RalinkTec  TargetNetwork
11:22:33:44:55:66    1  -71  1.0  Yes  Broadcom   LockedNetwork
77:88:99:AA:BB:CC   11  -63  2.0  No   AtherosC   HomeRouter

Key columns:

  • WPS — WPS version. Version 1.0 is older and more likely to be vulnerable to Pixie Dust. Version 2.0 added some mitigations but many implementations are still vulnerable.
  • Lck — whether WPS is currently locked. A locked AP has detected brute-force attempts and is blocking further WPS authentication. Locked APs are not worth attacking until the lock expires, which varies by vendor from minutes to hours.
  • Vendor — chipset vendor of the AP. Certain vendors are known to be vulnerable to Pixie Dust regardless of WPS version.

Ignore Locked APs

To filter out locked APs and only show viable targets:

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon | grep -v ' Yes '

Scan on a Specific Channel

To reduce noise and focus on a known target channel:

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon -c 6

Scan from an Existing Capture File

If you have already captured frames with airodump-ng, wash can parse WPS information elements from the pcap without needing a live interface:

┌──(kali㉿kali)-[~]
└─$ wash -f capture-01.cap

Bypass FCS Errors

Some adapters produce frames with bad frame check sequences that cause wash to drop them. If results seem incomplete, enable FCS error tolerance:

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon -C

The -C flag ignores FCS errors and processes all received frames. Use this if the output is empty despite APs being visible in airodump-ng.

Unlocked WPS 1.0 APs are the highest priority targets. Take note of the BSSID, channel, and vendor for each viable target before moving to the WPS attack phase.

References