New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow bruteforce for last digit instead of computing the checksum #49

Closed
adonespitogo opened this Issue Feb 7, 2016 · 5 comments

Comments

Projects
None yet
2 participants
@adonespitogo
Copy link

adonespitogo commented Feb 7, 2016

Hi, I stumbled upon this issue where reaver can't get the correct 2nd half of the pin. I found this issue (see coment#40) on google code archive and would like to know if there has been a fix for this or a feature that can accommodate manual brute force on the last digit of the pin. Thanks

@adonespitogo

This comment has been minimized.

Copy link
Author

adonespitogo commented Feb 7, 2016

I think this is irrelevant now. I just found out that what ever first 4 digit is used, the AP always sends m5 message tricking reaver that the first 4 digits are correct when in fact it's not. Any idea/workaround on this?

@soxrok2212

This comment has been minimized.

Copy link
Collaborator

soxrok2212 commented Feb 7, 2016

The only time this would be useful is if a user specifies the PIN. For example, if a user configures the 8 digit pin, it may not follow the checksum rule. I'd make a bet that if someone were smart enough to change the WPS PIN, they'd just disable the feature as a whole as it is a severely flawed protocol.

If you were to brute force the last 4 digits without a checksum, it would take another 9,000 guesses totaling at 20,000 for the whole PIN.

The AP will NEVER send a client the M5 message if the first half of the PIN is correct (unless there is a bug in the code or there is no PIN defined and WPS is enabled, but not configured).

@adonespitogo

This comment has been minimized.

Copy link
Author

adonespitogo commented Feb 7, 2016

Thanks for the quick reply. I think in my case the AP's WPS is enabled but not configured.

@soxrok2212

This comment has been minimized.

Copy link
Collaborator

soxrok2212 commented Feb 7, 2016

You can most likely check in Wireshark. Look in a Probe Response from the router and look for a WPS tag. I don't remember exactly where it is, but it may tell you in there.

@adonespitogo

This comment has been minimized.

Copy link
Author

adonespitogo commented Feb 7, 2016

I will try. Thanks

@soxrok2212 soxrok2212 closed this Mar 18, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment