security enabled verified medium v1.0.0

bully

WPS brute-force attack tool similar to Reaver but with improved reliability and performance.

📋 Live Preview 
bully -i {interface} -b {bssid}
🌍 interface → wlan0mon 🌍 bssid → 00:11:22:33:44:55 
bully -i {interface} -b {bssid}

Sandbox: execFile · Timeout: 86400s

Capabilities

network.wps.bruteforce
network.crack.wpa
network.pin.attack

Parameters

Name Type Required Default Description Aliases
interface string Yes - Wireless interface name (monitor mode) -i, --interface
bssid string Yes - Target AP BSSID -b, --bssid
channel integer No - Wireless channel of target AP -c, --channel
pin string No - WPS PIN to test -p, --pin
lock-delay integer No - Delay in seconds after lockout -l, --lock-delay
timeout integer No - Receive timeout in seconds -t, --timeout
delay integer No - Delay between pin attempts -d, --delay
session file No - Session file for resume support -s, --session
verbose boolean No - Enable verbose output -v, --verbose
force boolean No - Force attack even if AP is locked -F, --force
bruteforce boolean No - Brute-force the full PIN space -B, --bruteforce
step integer No - PIN increment step value -S, --step
o boolean No - Output to file -o, --output
q boolean No - Quiet output -q, --quiet
w boolean No - Work delay between cycles -w, --workdelay

Artifacts

TypeDescriptionMIMESchemaTrust
wireless.wps.pinRecovered WPS PINtext/plain-verified
wireless.wpa.pskCracked WPA passphrasetext/plain-verified

Contract

Inputs

wireless.interface

Wireless interface in monitor mode

wireless.bssid

Target AP BSSID

wireless.channel

Target channel

Outputs

wireless.wps.pin

Recovered WPS PIN

wireless.wpa.psk

WPA passphrase recovered via WPS

Side effects: network_trafficraw_socket_accessnetwork_traffic

Workflow Edges

Produces

wireless.wps.pinwireless.wpa.psk

Consumes

wireless.interfacewireless.bssidwireless.channel

Resource Profile

ResourceValue
CPUmedium
Memory32 MB
Networklow
Disk I/Olow

Examples

Basic WPS brute force

bully -i wlan0mon -b 00:11:22:33:44:55

With verbose output and channel

bully -i wlan0mon -b 00:11:22:33:44:55 -c 6 -v

Resume from saved session

bully -i wlan0mon -b 00:11:22:33:44:55 -s session.dat

Test specific PIN

bully -i wlan0mon -b 00:11:22:33:44:55 -p 12345670

Brute-force full PIN space

bully -i wlan0mon -b 00:11:22:33:44:55 -B

Force attack with lock delay

bully -i wlan0mon -b 00:11:22:33:44:55 -F -l 60

Fixed channel with step value

bully -i wlan0mon -b 00:11:22:33:44:55 -c 11 -S 10

Quiet mode with delay between pins

bully -i wlan0mon -b 00:11:22:33:44:55 -q -d 2

Documentation

Bully — WPS Brute-Force Tool

Bully is a WPS brute-force attack tool that serves as an alternative to Reaver with improved reliability, performance, and better handling of locked APs.

Advantages Over Reaver

  • More reliable EAPOL start and WSC data parsing
  • Better handling of WPS locked states
  • Improved detection of M5/M7 EAPol-forward errors
  • Lower CPU and memory footprint
  • Session save/resume compatible with Reaver sessions

Related Tools

reaveraircrack-ngwifite

References