Reaver

Reaver performs a brute force attack against an access point's Wi-Fi Protected Setup pin number. This package also provides the Wash executable, a utility for identifying WPS enabled access points. Reaver is used to target access points vulnerable to WPS attacks, allowing recovery of WPA PSK or reconfiguration of wireless settings.

Use cases include penetration testing of wireless networks with WPS enabled. Wash scans for networks to identify targets with WPS support. Reaver then brute forces the WPS PIN on the selected access point.

The tool operates on monitor-mode interfaces and requires the BSSID of the target AP. Sessions can be saved and restored for interrupted attacks.

Reaver implements a brute force attack against the Wi-Fi Protected Setup (WPS) protocol PIN. It associates with the target AP, sends WPS registration protocol messages with sequential PIN attempts, and processes responses to validate pins. Upon successful PIN recovery, it derives the WPA PSK from the WPS handshake or reconfigures AP settings. Wash discovers WPS-enabled APs by scanning beacons and probe responses for WPS information elements.