# WPS Network Discovery with wash

> Identifies WPS-enabled access points using wash, covering scan syntax, output interpretation, and filtering locked/unlocked networks for PIN-based attack assessment.

- **URL:** https://hackindex.io/platforms/wireless/reconnaissance/wps-network-discovery-with-wash
- **Path:** Wireless > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/wireless/reconnaissance.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-12

WPS (Wi-Fi Protected Setup) is a feature that allows devices to join a network without entering the full passphrase. It uses an 8-digit PIN that is vulnerable to brute-force due to a design flaw that allows it to be attacked in two halves, reducing the search space significantly. Some implementations are also vulnerable to the Pixie Dust attack, which recovers the PIN offline from a single exchange.

wash identifies which access points have WPS enabled and whether the WPS implementation is currently locked after failed attempts. Monitor mode must be active before running wash.

## WPS Network Discovery with wash

```bash
wash -i wlan0mon
# BSSID               Ch  dBm  WPS  Lck  Vendor    ESSID
# --------------------------------------------------------------------------------
# AA:BB:CC:DD:EE:FF    6  -54  2.0  No   RalinkTec  TargetNetwork
# 11:22:33:44:55:66    1  -71  1.0  Yes  Broadcom   LockedNetwork
# 77:88:99:AA:BB:CC   11  -63  2.0  No   AtherosC   HomeRouter
```

Key columns:

- **WPS**: WPS version. Version 1.0 is older and more likely to be vulnerable to Pixie Dust. Version 2.0 added some mitigations but many implementations are still vulnerable.
- **Lck**: whether WPS is currently locked. A locked AP has detected brute-force attempts and is blocking further WPS authentication. Locked APs are not worth attacking until the lock expires, which varies by vendor from minutes to hours.
- **Vendor**: chipset vendor of the AP. Certain vendors are known to be vulnerable to Pixie Dust regardless of WPS version.

## Ignore Locked APs

To filter out locked APs and only show viable targets:

```bash
wash -i wlan0mon | grep -v ' Yes '
```

## Scan on a Specific Channel

To reduce noise and focus on a known target channel:

```bash
wash -i wlan0mon -c 6
```

## Scan from an Existing Capture File

If you have already captured frames with airodump-ng, wash can parse WPS information elements from the pcap without needing a live interface:

```bash
wash -f capture-01.cap
```

## Bypass FCS Errors

Some adapters produce frames with bad frame check sequences that cause wash to drop them. If results seem incomplete, enable FCS error tolerance:

```bash
wash -i wlan0mon -C
```

The `-C` flag ignores FCS errors and processes all received frames. Use this if the output is empty despite APs being visible in airodump-ng.

When prioritizing targets from wash output, look for:

- **Unlocked WPS 1.0**: highest priority, most likely vulnerable to Pixie Dust and brute-force
- **Unlocked WPS 2.0**: may still be vulnerable depending on vendor implementation
- **Locked APs**: skip until the lock expires, which varies by vendor from minutes to hours

Take note of the BSSID, channel, and vendor for each viable target before moving to the WPS attack phase.

## References

- [reaver-wps-fork-t6x on GitHub](https://github.com/t6x/reaver-wps-fork-t6x) - wash source and documentation, maintained fork of the original reaver suite