So what is WPS?
Well, WPS was something that was done
to save users time and effort of configuring their devices.
It stands for Wi-Fi Protected Setup.
Now there's some flaws inside WPS,
and we can exploit that to be able to get onto
a WPA or WPA2 network
without having to even crack the password.
So the way WPS works
is there's usually a button on your router
or a PIN number on your router associated with it.
And what you would do is you'd push that button
and then you would tell your device to configure
and it would automatically find the router
and configure itself for that network.
And when it does that,
it uses a PIN code and it's an eight-digit PIN code
that it uses to be able to connect to this network.
So once you push the button,
it actually does a self-configuration
between the device and the endpoint.
And you can actually set up your wireless networks this way
very quickly and easily,
which is great for operations,
but it's very bad for security.
Now the reason it's bad for security is
because if somebody can touch a router,
'cause you're in your business,
they can get on very quickly,
but that requires some social engineering.
Now we can do some attacks against that WPS settings as well
to guess the PIN number.
The great thing about this WPS
from a security vulnerability standpoint,
if you want to call that "great,"
is that there's only seven digits to the PIN
because the 8th digit is reserved as a checksum.
So it's a fairly easy computation to guess all those digits
and be able to guess the PIN number
because you only have 10 to the 7th options here.
So you really only have less than 10 million passwords,
which sounds like a lot,
but for a computer that's pretty quick.
Now the other flaw that's inside a WPS
is that when you would guess a password,
for instance, if I guess the number 5682283,
it would go back and say,
"Ah, you got that wrong
because those first four digits were wrong."
But I can keep guessing those first four digits
and it will eventually tell me,
"Oh, you got the right first four digits."
And now I only have to guess the last three digits
because the way it actually passed the password
or the passcode here
was it broke that seven-digit number into two,
a four-section and a three-section,
which this an even easier problem to solve.
Because if I only have to go for four digits
to get it right the first time,
well, that's only 10,000 options.
And then those last three are only 1,000 options.
So it makes the problem very quick to solve
if you start going against a WPS-enabled network.
For this reason, a lot of newer networks,
people will turn off their WPS,
but in a lot of consumer grade
and small business environments,
WPS is still enabled.
Why?
Because it made configuring networks easy
and people like easy.
So they set this up, they leave it up,
and it makes it really simple for us as attackers
to be able to get on these networks,
as you'll see in the demonstration.
What we're going to do here
is work against that eight-digit PIN.
Now the last digit of that is actually a checksum.
So we only have to calculate the first seven digits.
And if you remember I talked about
that this breaks it up into four digits
and then three digits.
So it's only a 10,000
and 1,000 combinations we're looking at.
So it shouldn't take too long.
Now the biggest detriment here is
as we go through and hack it,
is the program we use here,
which is called Reaver,
it actually will have to wait about five seconds
in between each attempt.
Now by doing that,
that is going to slow us down.
And if it's a very high number PIN,
it could take all night for us to crack.
So we'll just let it run.
I'll pause the video and we'll come back
depending on what the passcode is on this particular router.
The first thing we need to do
is see if our card is in monitoring mode.
So we'll do that by doing iwconfig again.
And we can see here that it's actually in access point mode.
So we are going to use airmon-ng start,
and then wlan0, which is the name of this wireless card.
We'll hit Enter,
and that card will get turned into monitoring mode.
Now from the prompt,
we'll verify that by using iwconfig,
and you can see that card is now in monitoring mode
ready to do our bidding.
So we're going to clear our screen to bring
us back to the top
and we're going to use a program called Wash.
And if you do -h,
it will show you all the commands that are there for Wash.
There's two required arguments.
You have to have an interface
and if you want the packets to be read from a capture file,
you use -f.
Now we're going to do a live scan,
so we're just going to use wash -i
and then wlan0mon,
just like it shows in the example here.
And you'll see that it will start scanning
our wireless networks.
Now this works very similar to airmon.
The big difference here is that
this one is really focused on WPS.
You'll notice it has a lot less information.
We do have our MAC address right here of the access point.
It's on channel 1,
it is using WPS version 1,
and it is not locked,
which means it is vulnerable to this attack possibly.
So now that we've gotten the information we need,
we can hit Control + C,
get us back to the prompt,
and we're going to use a program called Reaver.
So I'm going to clear our screen
and we're going to look at Reaver.
reaver -h is going to show you the help file.
Now, Reaver is a Wi-Fi protected setup attack tool
that will allow us to go against WPS
and guess that PIN.
It's going to do that by doing a brute-force attack.
It's going to start with 1, 2, 3, 4, 5, 6, 7, 0
and go from there.
So we're going to have to give it a interface,
which is our wlan0mon.
We're going to give it our base station's MAC, that -b,
and then the MAC we just copied,
and we can leave it at that
and it'll just start scanning right from there.
And we can do that and see what's going to happen.
So let's start with that.
So to conduct this attack,
we're going to use reaver -i wlan0mon -b,
the MAC address of our card,
vv, which is verbose mode,
and then -K 1, just like the example
which is going to be using this option,
this pixie dust,
and we're going to use version 1 here.
And we'll hit Enter and see if it can crack our password.
Now if you notice,
I'm going to hit Control + C here.
You'll see that it keeps trying the same PIN.
This is a function of the way that
this router that we're attacking
is responding to these NACK.
So what we're going to do is
we're going to go back here to the help.
So we're ready to type in our command.
What we're going to use is reaver -i wlan0mon,
the base station, -b,
paste in that terminal ID,
vv for verbose,
and then we want to use no NACKs
because as you saw in the last example,
that NACK was just causing all sorts of problems for us.
We're going to -N, which will do no NACKs,
which is no acknowledgement messages.
And that way it'll keep going
and we'll get different PINs each time.
So we'll see if that works.
And here we go.
The first PIN is 1234567.
And the next one is different.
You'll see that these PINs are changing here.
And so now we're going through,
we're on the 6th PIN,
the 7th PIN.
I'm going to let this run
and when it finds one,
I'm going to come back to this video
because I don't want you to sit here
for what could be possibly several hours.
As you see right now, it is 5:52 my time.
We'll see what time it is when we come back
and this thing has solved its problem.
So you can see that it took a long time to find this PIN.
In fact, it tried over 10,000 combinations
until it finally found it.
Now when it did find it,
it did take us about 3 and a half hours.
Notice here that the PIN was cracked in 12,338 seconds.
And the PIN that we got was 21088612
shown here at the bottom.
But if we have just that PIN,
can we connect to the network?
Well, certainly we can use WPS
and we can connect to the network,
but really we'd like to know what the password is as well.
And so we're going to use a tool
called Bully to take that PIN,
connect to the network and figure out what the password is.
So first thing I'm going to do is
I'm going to clear my screen and bring us to the top.
Go ahead and copy that PIN number first
and then we are going to clear our screen.
Okay, so now that we found the PIN,
what we're going to do is we are going to clear the screen
and we are going to look for that network again
and we're going to try to connect to it one more time,
this time using the PIN.
So what we're going to use is wash -i wlan0mon,
just like we did before.
And notice we now have this BSSID,
which we're going to need.
So the next thing we're going to do
is we are going to use a program called Bully.
And the way Bully works is we use bully -h.
You can see here that Bully is going to allow us
to give it an interface and give it some options.
We're going to use the -b option,
which is the address,
the MAC address for that target access point
that we just got above.
And we're going to use the -p option
and give it a PIN number
because we know the PIN number
from what we just did with Reaver.
So what we're going to do here is I
wrote down my PIN number,
which was 21088612,
and I'm going to copy this BSSID
so that I don't have to type it out
'cause it's a longer thing to type out.
So what we're going to do is we're going to use bully -b
for the access point
and paste in that MAC address.
Then we're going to use -p for the PIN number.
And although we got an eight-digit PIN,
the PIN number itself only needs to be seven digits.
That 8th digit is actually a checksum.
So we're only going to give it seven digits,
leave off the last digit,
and then we're going to use the interface,
which is wlan0mon,
and hit Enter and away it'll go.
So there we go,
it found it immediately.
You could see here it has the PIN number
calculated fully with the last digit, the 2.
And it did find the key, Dr@g0nBr3@+h,
which is the password.
We do have the access point we attacked
and the name of the access point we attacked.
And so now just because we had WPS,
this did take us three to five hours,
in our case, 3 and a half hours to find this PIN number.
But once we have that PIN number,
we're able to reverse engineer that
by connecting to the access point
and getting that password.
And now simply using that password
we can connect to the access point with no issues.
Now the great thing about this
is that if somebody has WPS enabled,
often they'll remember to change their password,
but they won't remember to change their WPS code.
In fact, a lot of times the routers don't even allow you
to change the WPS code.
So I can go and change Dr@g0nBr3@+h to whatever I want
and no matter how long the password is,
if I still have that PIN number,
I can run this.
And you saw it took just a couple of seconds for Bully
to connect to it using that known PIN
and come back with a password.
This makes our life very, very simple.
So using these three tools:
Wash, Reaver, and Bully,
and just a couple hours,
you're able to have the password
that you want for that particular network.
So I hope you enjoy this quick tutorial
on how to crack WPS or Wi-Fi Protected Setup.
Now, what can you do to secure your networks
from this threat?
Well, if you have the option on your router,
turn off WPS.
Although it's great from a ease of use
of connecting new clients
by only have to type in those PIN numbers,
it is really, really bad for security as you saw here.
This attack works each and every time.
There is no known mitigation to stop this type of an attack.
It's just a matter of how long it's going to take you
to go through that entire key space of 11,000 keys,
in our case about 3 and a half hours.
Now, if you want to stop this completely,
the only mitigation there is is turning off WPS,
which really isn't even a mitigation
'cause you're taking away the service.
But by taking away that service,
you're going to prevent anyone from using this against you.