Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →snailsploit/offensive-wps
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation.
Passed 18 of 22 test cases with the skill, and 16 of 22 without it.
3 fixed15 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which major wireless chipset family commonly found in TRENDnet and Belkin routers is susceptible to offline EAPOL-M1/M4 nonce generation weakness?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Realtek chipsets as vulnerable to offline nonce attacks. | Missed | Passed |
The instructions your model reads when the skill loads.
WPS converts an 8-digit PIN into the network PSK via the M3/M4 message exchange. The PIN is split into 4-digit + 3-digit halves (the 8th digit is a checksum), giving only 11,000 effective combinations — and on vulnerable chipsets, the offline Pixie Dust attack recovers the PIN in seconds without ever sending an online attempt.
# wash — dedicated WPS scanner
sudo wash -i wlan0mon
# Or use airodump-ng with WPS column
sudo airodump-ng wlan0mon --wps
Output includes: WPS version (1.0 / 2.0), Locked status, Configured/Unconfigured, vendor.
WPS 2.0 introduced lockout enforcement, but many consumer APs still implement it as "lock for 60 seconds after 3 failures" — easily bypassed by waiting.
The Pixie Dust attack exploits weak nonce generation in WPS-implementing chipsets. The attack captures one full WPS handshake (M1-M4) and then offline-computes the PIN.
# reaver with Pixie Dust mode
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
# bully alternative
sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon
| Chipset | Vulnerable? |
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.