security enabled verified medium v1.0.0

reaver

WiFi Protected Setup (WPS) PIN brute-force attack tool for recovering WPA/WPA2 passphrases.

📋 Live Preview

reaver -i {interface} -b {bssid}

🌍 interface → wlan0mon 🌍 bssid → 00:11:22:33:44:55

reaver -i {interface} -b {bssid}

Sandbox: execFile · Timeout: 86400s

Capabilities

network.wps.bruteforce

network.crack.wpa

network.pin.attack

Parameters

Name	Type	Required	Default	Description	Aliases
`interface`	string	Yes	-	Wireless interface name (monitor mode)	`-i`, `--interface`
`bssid`	string	Yes	-	Target AP BSSID	`-b`, `--bssid`
`channel`	integer	No	-	Wireless channel of target AP	`-c`, `--channel`
`pin`	string	No	-	WPS PIN to test	`-p`, `--pin`
`lock-delay`	integer	No	-	Delay in seconds after WPS lockout	`-l`, `--lock-delay`
`timeout`	integer	No	-	Receive timeout in seconds	`-t`, `--timeout`
`session-file`	file	No	-	Session file for resume support	`-s`, `--session`
`verbose`	boolean	No	-	Enable verbose output	`-v`, `--verbose`
`quiet`	boolean	No	-	Quiet mode, suppress output	`-q`, `--quiet`
`auto`	boolean	No	-	Auto-detect best advanced options	`-a`, `--auto`
`no-associate`	boolean	No	-	Do not associate with AP	`-A`, `--no-associate`
`exhaustive`	boolean	No	-	Exhaustive PIN search	`-X`, `--exhaustive`
`N`	boolean	No	-	Ignore NACKs	`-N`, `--no-nacks`
`W`	boolean	No	-	Windows 7 compatibility	`-W`, `--win7-compat`
`d`	boolean	No	-	Delay between PIN attempts	`-d`, `--delay`
`f`	boolean	No	-	Disable channel hopping	`-f`, `--fixed`
`o`	boolean	No	-	Output to file	`-o`, `--output`
`r`	boolean	No	-	Recurring delay	`-r`, `--recurring-delay`

Artifacts

Type	Description	MIME	Schema	Trust
`wireless.wps.pin`	Recovered WPS PIN	text/plain	-	verified
`wireless.wpa.psk`	Cracked WPA passphrase	text/plain	-	verified

Contract

Inputs

wireless.interface

Wireless interface in monitor mode

wireless.bssid

Target AP BSSID

wireless.channel

Target channel

Outputs

wireless.wps.pin

Recovered WPS PIN

wireless.wpa.psk

WPA passphrase recovered via WPS

Side effects: network_trafficraw_socket_accessnetwork_traffic

Workflow Edges

Produces

wireless.wps.pinwireless.wpa.psk

Consumes

wireless.interfacewireless.bssidwireless.channel

Resource Profile

Resource	Value
CPU	medium
Memory	32 MB
Network	low
Disk I/O	low

Examples

Basic WPS PIN brute force

reaver -i wlan0mon -b 00:11:22:33:44:55

With channel and verbose output

reaver -i wlan0mon -b 00:11:22:33:44:55 -c 6 -vv

Resume from saved session

reaver -i wlan0mon -b 00:11:22:33:44:55 -s session.wpc

Test specific PIN

reaver -i wlan0mon -b 00:11:22:33:44:55 -p 12345670

With lockout delay and no association

reaver -i wlan0mon -b 00:11:22:33:44:55 -l 60 -A

Exhaustive mode with auto options

reaver -i wlan0mon -b 00:11:22:33:44:55 -X -a

Quiet mode with 30s timeout

reaver -i wlan0mon -b 00:11:22:33:44:55 -q -t 30

Fixed channel with delay

reaver -i wlan0mon -b 00:11:22:33:44:55 -c 11 -d 5

Documentation

Reaver — WPS PIN Attack Tool

Reaver performs a brute-force attack against WiFi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases. It targets the WPS vulnerability in access points that have WPS enabled.

How It Works

Reaver sends WPS PIN attempts to the target AP. When the correct PIN is found, the AP reveals the WPA/WPA2 passphrase. The default WPS PIN is often 8 digits, with the last digit being a checksum.