Skip to content
HackIndex logo

HackIndex

Detecting WPS Vulnerable Networks

3 min read Mar 17, 2026

WPS (Wi-Fi Protected Setup) has two well-known vulnerabilities. The PIN brute-force attack exploits a design flaw where the 8-digit PIN is validated in two independent halves, reducing the effective search space from 100 million to around 11,000 attempts. The Pixie Dust attack recovers the PIN offline from a single exchange by exploiting weak random number generation in certain chipset firmware. Both attacks bypass the WPA2 passphrase entirely and recover it directly from the AP.

wash identifies which APs have WPS enabled and whether the WPS state is currently locked from previous failed attempts.

Scan for WPS-Enabled Networks

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon 
BSSID               Ch  dBm  WPS  Lck  Vendor    ESSID
--------------------------------------------------------------------------------
AA:BB:CC:DD:EE:FF    6  -54  2.0  No   RalinkTec  TargetNetwork
11:22:33:44:55:66    1  -71  1.0  Yes  Broadcom   LockedNetwork
77:88:99:AA:BB:CC   11  -63  2.0  No   AtherosC   HomeRouter
FF:EE:DD:CC:BB:AA    6  -48  1.0  No   Realtek    OldAP

Prioritise targets based on the following:

  • Lck: No — WPS is active and accepting attempts. This is a viable target.
  • Lck: Yes — WPS is temporarily locked after failed attempts. The lockout period varies by vendor from a few minutes to several hours. Not worth attempting until unlocked.
  • WPS 1.0 — older implementation, higher likelihood of Pixie Dust vulnerability depending on vendor chipset.
  • WPS 2.0 — added some mitigations but many implementations remain vulnerable to both PIN brute-force and Pixie Dust.
  • Vendor — certain vendors are known to be Pixie Dust vulnerable regardless of WPS version. Ralink, Realtek, and some Broadcom chipsets have documented Pixie Dust vulnerabilities.

Handle FCS Errors

If wash returns no results despite APs being visible in airodump-ng, the adapter may be producing frames with bad frame check sequences. Enable FCS tolerance:

┌──(kali㉿kali)-[~]
└─$ wash -i wlan0mon -C

Confirm WPS from an Existing Capture

If you have already captured frames with airodump-ng, wash can extract WPS information elements without needing a live interface:

┌──(kali㉿kali)-[~]
└─$ wash -f capture-01.cap

Confirm WPS State with iw

iw scan output includes the WPS information element when present in the beacon:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 40 "AA:BB:CC:DD:EE:FF" | grep -A 5 "WPS" 
WPS:	 * Version: 2.0
	 * Wi-Fi Protected Setup State: 2 (Configured)
	 * Response Type: 3 (AP)
	 * UUID-E: ...
	 * Manufacturer: Ralink Technology

Wi-Fi Protected Setup State: 2 (Configured) means WPS is active and the AP has been set up. State 1 means unconfigured. The Manufacturer field here cross-references against known Pixie Dust vulnerable vendors.

Document the Finding

For each viable target record the BSSID, SSID, channel, WPS version, lock status, and vendor. Unlocked WPS 1.0 networks on Ralink or Realtek chipsets are the highest priority for Pixie Dust. Any unlocked WPS network regardless of version is a PIN brute-force candidate. Locked networks should be re-checked after the lockout period expires.

References