Bully

Bully is a high-performance implementation of the WPS brute force attack written in C. It targets the well-known design flaw in WPS implementations that allows PIN recovery through systematic brute force attempts. The tool supports both BSSID and ESSID targeting and works with wireless interfaces in monitor mode.

Key advantages over the original Reaver implementation include fewer dependencies, better memory and CPU efficiency, proper endianness handling, and a more robust option set. Bully is particularly effective against access points that have WPS enabled, even when locked, with configurable lockout delay handling.

Use cases include wireless penetration testing, WPS vulnerability assessment, and security auditing of wireless networks. The tool creates randomized PIN files and maintains state across sessions for efficient recovery.

Bully exploits the WPS PIN brute force vulnerability by sending authentication messages (M1-M7) to the target access point in monitor mode. It systematically tries 8-digit WPS PINs, leveraging the reduced search space from the checksum algorithm (first 4 digits, then last 4). The tool handles WPS lockouts with configurable delays, supports pixiewps for offline PIN recovery using timing attacks, and maintains session state with pin index tracking. It uses radiotap headers and proper datalink type handling for packet transmission.