2KKUU7ita

Figure 9-10:
The Reaver
startup
window.
Chapter 9: Wireless LANs
WPS is intended for consumer use in home wireless networks. If your wireless
environment is like most others that I see, it probably contains consumergrade
wireless APs (routers) that are vulnerable to this attack.
The WPS attack is relatively straightforward using an open source tool called
Reaver (http://code.google.com/p/reaver-wps). Reaver works by
executing a brute-force attack against the WPS PIN. I’ve been using the commercial
version, Reaver Pro (http://hakshop.myshopify.com/products/
reaver-pro), which comes with a bootable USB thumb drive and wireless
adapter to streamline the process. Reaver’s interface, as shown in Figure
9-10, is pretty straightforward.
Running Reaver is easy. You simply follow these steps:
1. Load Reaver and click the Play button in the middle of the window.
2. Click the Play button in the attack column next to the AP you want to
crack.
3. Let Reaver run and do its thing.
This process is shown in Figure 9-11.
It can take anywhere from a few minutes to a few hours, but if successful,
Reaver will return the WPA pre-shared key. You can pause and resume the
cracking at any time.
171