billhibazzz / reaver-wps Goto Github PK

BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ $ root


BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.

Nokia-N900:~# cd trunk/src/
Nokia-N900:~/trunk/src# ./configure
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... yes
configure: creating ./config.status
config.status: creating Makefile
Nokia-N900:~/trunk/src# 


BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ $ root


BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.

Nokia-N900:~# cd trunk/src/
Nokia-N900:~/trunk/src# make
(cd libwps && make)
make[1]: Entering directory `/root/trunk/src/libwps'
make[1]: `libwps.o' is up to date.
make[1]: Leaving directory `/root/trunk/src/libwps'
(cd utils && make)
make[1]: Entering directory `/root/trunk/src/utils'
Makefile:36: no file name for `-include'
ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o 
wpa_debug.o wpabuf.o os_unix.o eloop.o
ar: illegal option -- T
Usage: ar [emulation options] [-]{dmpqrstx}[abcfilNoPsSuvV] [member-name] 
[count] archive-file file...
ar -M [<mri-script]
commands:
d - delete file(s) from the archive
m[ab] - move file(s) in the archive
p - print file(s) found in the archive
q[f] - quick append file(s) to the archive
r[ab][f][u] - replace existing or insert new file(s) into the archive
t - display contents of archive
x[o] - extract file(s) from the archive
command specific modifiers:
[a] - put file(s) after [member-name]
[b] - put file(s) before [member-name] (same as [i])
[N] - use instance [count] of name
[f] - truncate inserted file names
[P] - use full path names when matching
[o] - preserve original dates
[u] - only replace files that are newer than current archive contents
generic modifiers:
[c] - do not warn if the library had to be created
[s] - create an archive index (cf. ranlib)
[S] - do not build a symbol table
[v] - be verbose
[V] - display the version number
@<file> - read options from <file>
emulation options:
No emulation specific options
ar: supported targets: elf32-littlearm elf32-bigarm elf32-little elf32-big srec 
symbolsrec tekhex binary ihex
make[1]: *** [libutils.a] Error 1
make[1]: Leaving directory `/root/trunk/src/utils'
make: *** [libutils] Error 2
Nokia-N900:~/trunk/src#



What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?
r35


Please provide any additional information below.

It happened to me that the first 4 digits were already cracked, and it was 
coming down to the last section (3 digits + checksum). But then the AP 
disappeared/crashed etc. 

I would like to tell the program to use the first 4 digits of the pin that i 
have previously obtained for further cracking.

Sounds like a small addition, and could be very useful.

Is it possible to work in many threads, so speeding up the bruteforce process?

What steps will reproduce the problem?
1. executing reaver with given example usage
2.
3.

What is the expected output? What do you see instead?

Does not work with my driver apparently...

[-] Failed to initialize interface 'wlan0'
[-] Failed to recover WPA key

What version of the product are you using? On what operating system?

reaver v1.1
3.1.5 Kernel
ArchLinux x86_64

Please provide any additional information below.

Have tried both iwconfig and airmon-ng and verified my card is in monitor mode 
and ready for action but no love... I know my card supports injection etc. but 
for some odd reason reaver doesn't like it.

What steps will reproduce the problem?
1. updated from r32 to r33
2. ran reaver
3.

What is the expected output? What do you see instead?
with r32 i was getting about 2 seconds/attempt with random timeouts. r33 is 
getting mostly timeouts and slowed to 10-20 seconds/attempt.
reverting to r32 solved issue.

What version of the product are you using? On what operating system?
bt5


Please provide any additional information below.

I am using reaver on a Fedora 16 install..

#uname -a
Linux Fedora16 3.1.5-6.fc16.i686.PAE #1 SMP Thu Dec 15 16:19:31 UTC 2011 i686 
i686 i386 GNU/Linux

The network card I am using is an Alfa Wireless AWUS035H

I grab the BSSIS from the following

# islist wlan0 

          Cell 01 - Address: 00:22:3F:39:3B:78
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=43/70  Signal level=-67 dBm  
                    Encryption key:on
                    ESSID:"burp"
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
                              12 Mb/s; 24 Mb/s; 36 Mb/s
                    Bit Rates:9 Mb/s; 18 Mb/s; 48 Mb/s; 54 Mb/s
                    Mode:Master
                    Extra:tsf=000000c54f399c7f
                    Extra: Last beacon: 80ms ago
                    IE: Unknown: 000462757270
                    IE: Unknown: 010882848B960C183048
                    IE: Unknown: 03010B
                    IE: Unknown: 2A0100
                    IE: Unknown: 32041224606C
                    IE: WPA Version 1
                        Group Cipher : TKIP
                        Pairwise Ciphers (1) : TKIP
                        Authentication Suites (1) : PSK


# reaver -i wlan0 -b 00:22:3F:39:3B:78 -vv

Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from 00:22:3F:39:3B:78

After waiting an hour it never did anything else.

Thanks for the hard work!

What steps will reproduce the problem?
1. Loaded VMWARE Aircrack distro
2. Run configure and make
3. fails with plib requirements 

What is the expected output? What do you see instead?
Successful install instead plib fails requiring gl

What version of the product are you using? On what operating system?
1.1

Please provide any additional information below.
Does the install require GL video card?

What steps will reproduce the problem?
1. run reaver as usuall
2. bruteforce the PIN
3. reaver guesses the right PIN and outputs the WPA PSK

What is the expected output? What do you see instead?
Expected output is the WPA passphrase or WPA PSK needed for auth with AP.
After a valid PIN is tested reaver reports wrong PSK key, and when run against 
the same AP , reports a different one.

What version of the product are you using? On what operating system?
1.1 on 2.6 linux with ath5k 

Please provide any additional information below.

not sure if this is some sort of a bug in reaver or it's just that my AP is 
generating per client WPA PSK . If that is the case, any idea how to actually 
get the passphrase/PSK?

Note that reaver get the RIGHT PIN (i actually hardcoded it for testing )

---
./reaver --help

Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<cheffner@tacnetso                                                              
               l.com>

Segmentation fault

---

want me to recompile with symbols and run it with gdb ?

In the case the pin is already known and the key has been changed, it would be 
convenient to be able to specify the pin so the key can be retrieved instantly.

What steps will reproduce the problem?
1. Start reaver specifying -c
2. Program returns immediately
3.

What is the expected output? What do you see instead?
Expected to not channel hop and lock to channel specified by -c
Program returns immediately

What version of the product are you using? On what operating system?
1.1 on linux 2.6.38

Please provide any additional information below.
Program seems to find the channel if -c is not specified and begins the attack.

running latest stable ubuntu 64,
reaver -i $dev -b $ssid always segfaults

backtrace: 

#0  0x000000000041290a in wps_registrar_expire_pins (reg=0x0) at 
wps_registrar.c:559
#1  0x0000000000412a83 in wps_registrar_get_pin (reg=0x0, uuid=0x6cf724 "", 
pin_len=0x7fffffffdf90) at wps_registrar.c:600
#2  0x0000000000413909 in wps_get_dev_password (wps=0x6cf700) at 
wps_registrar.c:1000
#3  0x000000000041558f in wps_registrar_get_msg (wps=0x6cf700, 
op_code=0x7fffffffe014) at wps_registrar.c:1615
#4  0x0000000000407bfc in send_msg () at send.c:80
#5  0x0000000000405c18 in do_wps_exchange () at exchange.c:66
#6  0x00000000004057b1 in crack () at cracker.c:160
#7  0x00000000004027a8 in main (argc=6, argv=0x7fffffffe1d8) at wpscrack.c:80

as you can see reg is 0

What steps will reproduce the problem?
1. start in verbose mode and pick any mac...
The software is displaying which channels it is hopping but always skips the 
first channel.

Thanks and regards,
Boris

What steps will reproduce the problem?
1. reaver -i wlan0 -b XX:XX:XX:XX:XX:XX

What is the expected output? What do you see instead?
Reaver hangs on "Waiting for beacon from XX:XX:XX:XX:XX:XX". It is not a range 
problem, I am able to wirelessly connect to the router using the PSK. It always 
hangs on this message on all 3 routers I have tried.

What version of the product are you using? On what operating system?
ver: reaver rev 22
os: fedora 16
wifi: Ralink corp. RT2860 (Device 2790)
driver: rt2800pci

Please provide any additional information below.
Specifying essid and using -c and -f does not cure the problem, -vv provides no 
more information. Hangs for 5 minutes, still waiting.

What steps will reproduce the problem?
1. Everytime I start the bruteforce. I changed the AP, same problem :(
2.
3.

What is the expected output? What do you see instead?

- Changing keys in every line. 
- Always the same is tested.

What version of the product are you using? On what operating system?

- BT5 R1  RT3070
- Reaver 1.2 rv35


Please provide any additional information below.

Reaver v1.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from 88:25:2C:52:67:63
[+] Switching mon0 to channel 6
[+] Associated with 88:25:2C:52:67:63 (ESSID: WLAN-F58613)
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[!] WARNING: Receive timeout occurred
[!] WARNING: 10 failed connections in a row
[+] Trying pin 57245515
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 57245515

What steps will reproduce the problem?
1. Start reaver (reaver -i mon0 -b *BSSID* -c 11 -vv)
2. Wait for it to associate and try one pin.
3. Receive the error

What is the expected output? What do you see instead?
[+] Waiting for beacon from 00:1D:7E:B5:0C:66
[+] Switching mon0 to channel 11
[+] Associated with *BSID* (ESSID: net)
[+] Trying pin 86274814

Clearly the above is OK but after it tries the following it constantly outputs 
the follow.

[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous 
message

What version of the product are you using? On what operating system?
Reaver 1.1 in Backtrack 4 R2
Alfa AWUS036NH with rt2800usb
Linksys WAG160N

Please provide any additional information below.

Sorry if this has already been discussed however I could not find mention of it 
in other bug reports. Many thanks.

A few minutes into the attack, Reaver detects rate limiting. After about 20 
minutes it is still detecting rate limiting.

However, if I quit Reaver and restart the attack, it will start trying pins 
again successfully.


Ubuntu 11.10 64 bit
rtl8187
Reaver r20

What steps will reproduce the problem?
1. Run reaver, let it do it's thing
2. If for some reason it's been through the whole list of possibilities, it 
will continue looping the last pin

One of these scenarios is bug #12

What is the expected output? What do you see instead?
After the list of possible pincodes is exhausted, i expect Reaver to give me 
feedback, ie.: First part cracked:, couldn't crack 2nd part.
This is not the case, instead it keeps on going with the last pincode and never 
reaches 100%:

+] Trying pin 47702738
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889

etc.

What version of the product are you using? On what operating system?
v16 SVN

Please provide any additional information below.

What steps will reproduce the problem?
1. Run reaver, crack first 4 digits and let the program continue.
2. At some point it will try:
  [+] Trying pin 47704244
  [!] WARNING: Receive timeout occurred

However, this is the correct pin, but due to a timeout, it is skipped, not 
repeated?

What is the expected output? What do you see instead?
I see that it continues to crack other pins, but not repeating the correct one. 
I believe it's supposed to retry the pins that encountered a timeout.

What version of the product are you using? On what operating system?
latest svn checkout (v16)

Please provide any additional information below.

This tool would be even more awesome if it could dodge lockdowns !

What about changing mac adress by each try to maybe dodge the security used by 
most newer routers ?

Regards from NeZZeR.

 Keep up the good work and make it seen at the backtrack forums !

What steps will reproduce the problem?
1. installing
2.
3.

What is the expected output? What do you see instead?
root@ubuntu:/home/toor/Bureau/reaver-1.2/src# make install
if [ ! -d /etc/reaver ]; then mkdir /etc/reaver; fi
if [ -e reaver ]; then cp reaver /usr/local/bin/reaver; fi
ln -s /usr/local/bin/reaver /usr/bin/reaver

What version of the product are you using? On what operating system?
Ubuntu11.04

Please provide any additional information below.
Please can you help me 

There is some litle video:

http://www.youtube.com/user/MaurisTechChannel
( 1st Video at his Channel )

What steps will reproduce the problem?
Does not compile on Mac OS X

What is the expected output? What do you see instead?
Success

What version of the product are you using? On what operating system?
10.6 OS X

Please provide any additional information below.

Anyone up for porting it to Mac OS X and *BSD?

What steps will reproduce the problem?
1. Linksys WRT54G/GL/GS with Firmware: DD-WRT v24-sp2 (10/10/09) mini
2. airodump-ng mon0
3. Cancel airdump-ng and copy target bssid
3. reaver -i mon0 -b 00:01:02:03:04:05 -c 6 -vv

What is the expected output? What do you see instead?

After getting a beacon frame it gets associated but never starts the pin tries.

What version of the product are you using? On what operating system?

Backtrack 5r1 64bit

Please provide any additional information below.

Researching DD-WRT's site it was revealed that DD-WRT DOES NOT support WPS and 
configured the WPS button to work as a Reset Button

What steps will reproduce the problem?
Hardware - ALFA AWUS036H
Running the following command within Reaver
reaver -i mon0 -b *AP MAC*

What is the expected output? What do you see instead?
The expected output is association with the target AP. Instead I receive the 
following
http://pastebin.com/KAYwGWs0

What version of the product are you using? On what operating system?
Reaver-1.0
Backtrack 5

Please provide any additional information below.
I am able to associate with the AP using Aireplay-ng, but Reaver is unable to 
do so.

What steps will reproduce the problem?
1. Attack Vodafone EasyBox 803 (or probably any device manufactured by arcadyan 
with wps-pin)
2. Sniff with Wireshark whats happening

What is the expected output?
It's expectet that your tool iterates through the pins

What do you see instead?
It does not iterate through the pins, instead:
---------------------
root@fuckup:src $ ./reaver -i mon0 -b 7C:4F:B5:C8:64:09 -vv

Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from 7C:4F:B5:C8:64:09
[+] Switching mon0 to channel 1
[+] Associated with 7C:4F:B5:C8:64:09 (ESSID: EasyBox-C86429)
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[!] WARNING: 10 failed connections in a row
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
---------------------

What version of the product are you using?
SVN Version of today

On what operating system?
BackTrack 5R1 x85 KDE


Please provide any additional information below.
Packet-Dump is attached.
I use the alfa awus036h with the rtl8187 chipset (as you do)
I looked into the dump allready together with Stefan Viehboeck and he is of the 
opintion that this "WPS, MD2" packet in the EAP-packets should normally not be 
there.

I am pretty sure it should work since i can log in with wps-pin from windows7 
into the device. That device is also the one which got Stefan initially started 
to research the problem. Would be great if you could take a look into the dump.

cya

What steps will reproduce the problem?
1. Start reaver specifying -i and -b
2. The pin usually gets 'stuck', repeating the same one

What is the expected output?
Continuously changing pin.

What do you see instead?
The same pin repeated.

What version of the product are you using? On what operating system?
1.1 on linux, kernel 2.6.38 using ath9k

Please provide any additional information below.
None at this time.

What steps will reproduce the problem?

1. Open reaver-1.2.tar.gz on android file explorer.


What is the expected output? What do you see instead?

Hacking WPA/WPA2 everywhere!


What version of the product are you using? On what operating system?

reaver-1.2.tar.gz on Android 2.3.7


Please provide any additional information below.

Is breaking wpa/wpa2 everywhere on our android device will not be great?

>What steps will reproduce the problem?
Normal usage to an AP 1M away from my adaptor

>What is the expected output? What do you see instead?

Expected o/p is rorating PIN Until successful completion. What I see is the PIN 
will change for about 1 minute and then get stuck on the same PIN.AP is a 
Netgear WNR2200

>What version of the product are you using? On what operating system?

--reaver 1.2 (no SVN updates)
--Ubuntu 11.10 64-bit
--Alpha AWUS036H USB adaptor

>Please provide any additional information below.

pcap file attached.I was getting the segmentation fault but this has 
dissapeared.THis may be a localised AP issue as on other AP's with very good 
RSSI, I dont get the "stuck" PIN but what I do get are/is very frequent 
timeouts.I will raise this on a seperate ticket?

Great tool, BTW.I'm a bot of a noob when it comes to LInux but very interested 
in wireless.Anything else you need, just let me know.

What is the expected output? What do you see instead?
6.34% completed; got 90.93% complete.


What version of the product are you using? On what operating system?
Rev 26, Backtrack 5 x32

Please provide any additional information below.

http://i.imgur.com/F1LO2.png

Currently, only Linux platform is supported.

How difficult would it be to port reaver-wps to OS X?

>What steps will reproduce the problem?

1. Initialize Reaver normally.
2. Press the 'WPS' Button (hard or soft) on the AP


>What is the expected output? What do you see instead?

Expected nothing.
Program Returns:

[+] Trying pin 42616139
[+] Key cracked in 2155 seconds
[+] WPS PIN: '42616139'

Cracked PIN is not the AP PIN number, the PIN that was being tested when the AP 
WPS button was pressed, would make sense, as the AP allows a different type of 
PIN check when pressing its WPS button, either on the device itself or the 
admin webpage, the admin webpage of the AP tested lists its own PIN, which is 
different from the cracked PIN in this case.

>What version of the product are you using? On what operating system?

--Reaver1.0
--Ubuntu11.10
--WAG120N AP

>Please provide any additional information below.

I'm not sure exactly how this program works, though I can assume the engine for 
cracking uses the NACK to determine failure, if there is no NACK at the end of 
the handshake does the program assume success and stop with a PIN it thinks is 
correct?

What steps will reproduce the problem?
1. Download source
2. Unzip
3. ./configure
4. make - fails

What is the expected output? What do you see instead?
Expected output is a successful 'make'.
I see many errors halfway through the make compile:

iwlib.c:2661: warning: (near initialization for ‘standard_event_descr[8]’)
iwlib.c:2662: error: unknown field ‘max_tokens’ specified in initializer

iwlib.c:3002: error: ‘iwstats’ has no member named ‘qual’
iwlib.c:3011: error: ‘struct iw_event’ has no member named ‘u’
iwlib.c:3080: error: ‘union iwreq_data’ has no member named ‘data’
iwlib.c:3096: error: request for member ‘length’ in something not a 
structure or union

etc.

What version of the product are you using? 
reaver1.2

On what operating system?
MacOSX Lion

Please provide any additional information below.

running bt5 rc 32, reaver 1.2 (no svn update)

this is what I get on 3 differents access point:

reaver -i mon0 -b 00:14:D1:50:8E:46

Reaver v1.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from 00:14:D1:50:8E:46
[+] Associated with 00:14:D1:50:8E:46 (ESSID: house)
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
........

Is there a way to detect if an AP has WPS support? If so it would be helpful if 
Reaver told you this and exited if support was not found.

What steps will reproduce the problem?
1. run reaver: "reaver -i mon0 -b xx:xx:xx:xx:xx:xx -vv -c 1"
2. wait until message appears "[!] WARNING: Detected AP rate limiting, waiting 
315 seconds before re-trying"

What is the expected output? What do you see instead?
After waiting 315 seconds the attack should resume. Instead reaver is waiting 
another 315 seconds; over and over again.

What version of the product are you using? On what operating system?
I am using Backtrack 5 R1 and reaver r22, b43 driver

Please provide any additional information below.
The attack works until 0.25% is reached,
[+] 0.25% complete @ 3 seconds/attempt
then reaver waits forever to resume,
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
even though I am able to cancel the attack, immediately restart it and then it 
works again until ca. 0.25% is reached.

Router is "Netgear WNDR3400".

Would it be possible for reaver to store somewhere in a database/text file what 
PINs were already tested against which BSSID?

for example when you are testing PINs on a remote location and suddenly you 
have to leave and it didn't crack the PIN yet.
Next time you come there, would it be possible to resume instead of starting 
from beginning?

some assumptions needed:
PIN did not change in a mean time
??? anything else is required ???

would it be technically possible?

Moved from issue #2:


Comment 20 by gorilla.maguila, Today (43 minutes ago)
This is what I get with latest subversion:

[+] Waiting for beacon from C0:3F:0E:C1:DB:A7
[+] Switching mon0 to channel 2
[+] Switching mon0 to channel 4
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 
[+] Associated with C0:3F:0E:C1:DB:A7 
[+] Trying pin 90553301
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 
[+] Switching mon0 to channel 3
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
Segmentation fault

I'm under kernel 3.1.5 with iwlagn driver



Comment 21 by project member [email protected], Today (33 minutes ago)
maguila,

I have not tested the iwlagn drivers, but since you were able to associate I'd 
suspect that injection is working properly. The failed associations and receive 
timeouts are usually an indication of poor signal strength or a lot of wireless 
interference.

The segfault is troubling though. Can you give more info on your OS ?



Comment 22 by gorilla.maguila, Today (12 minutes ago)
I'm using Archlinux x64. We use almost the latest packages on everything as it 
is a rolling release distro.

I have tried to run under gdb but I don't know why I don't get the segmentation 
fault:

$gdb ./reaver
GNU gdb (GDB) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/user/reaver-wps-read-only/src/reaver...done.
(gdb) run -i mon0 -b C0:3F:0E:C1:DB:A7 -vv
Starting program: /home/user/reaver-wps-read-only/src/reaver -i mon0 -b 
C0:3F:0E:C1:DB:A7 -vv

Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from C0:3F:0E:C1:DB:A7
[+] Switching mon0 to channel 4
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Associated with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Trying pin 26141367
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Switching mon0 to channel 2
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
...etc

But again I get the segmentation fault without gdb.

I compiled the code in openwrt build tree. It does compile and seems to run. 
Although the code does now compile using this makefile it does not run properly.

It does start hopping the channels but never associates.


Please find a copy of the makefile :-
#
# Copyright (C) 2012 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#

include $(TOPDIR)/rules.mk

PKG_NAME:=reaver-wps
PKG_REV:=35
PKG_VERSION:=r$(PKG_REV)
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
PKG_SOURCE_PROTO:=svn
PKG_SOURCE_URL:=http://reaver-wps.googlecode.com/svn/trunk/src
PKG_SOURCE_VERSION:=$(PKG_REV)

include $(INCLUDE_DIR)/package.mk

define Package/reaver-wps
  SECTION:=net
  CATEGORY:=Network
  SUBMENU:=wireless
  TITLE:=Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs
  URL:=http://code.google.com/p/reaver-wps/
  DEPENDS:=+libpcap 
endef

define Package/reaver-wps/description
  Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2
  passphrases, as described in http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf .
endef

TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/

define Build/Prepare
    $(call Build/Prepare/Default)
#   sed -i 's/Q=@/Q=/' $(PKG_BUILD_DIR)/common/lib.rules
    sed -i 's/$$$$(CC)/$$$$(CC) $$$$(CFLAGS)/' $(PKG_BUILD_DIR)/wps/Makefile
    sed -i 's/CC=gcc/CC?=gcc/' $(PKG_BUILD_DIR)/libwps/Makefile
    sed -i 's/CFLAGS=/CFLAGS+=/' $(PKG_BUILD_DIR)/libwps/Makefile
    sed -i 's/CC = gcc/CC ?= gcc/' $(PKG_BUILD_DIR)/lwe/Makefile
    sed -i 's/AR = ar/AR ?= ar/' $(PKG_BUILD_DIR)/lwe/Makefile
    sed -i 's/RANLIB = ranlib/RANLIB ?= ranlib/' $(PKG_BUILD_DIR)/lwe/Makefile
    sed -i 's/CFLAGS=/CFLAGS+=/' $(PKG_BUILD_DIR)/lwe/Makefile
endef

define Package/reaver-wps/install
    $(INSTALL_DIR) $(1)/usr/sbin
    $(INSTALL_BIN) $(PKG_BUILD_DIR)/reaver $(1)/usr/sbin/
endef

$(eval $(call BuildPackage,reaver-wps))






http://paste.debian.net/150669/




What version of the product are you using? On what operating system? r35

Hello guys,

I know some routers have default pin numbers (12345670 for instance). I was 
wondering if it was possible to add an option to reaver-wps that would allow 
the user to manually specify a pin number to try.

Thank you very much !

What steps will reproduce the problem?
1. ./configure worked fine
2. make throws error: ar: illegal option -- T
3. make exits with errors


What version of the product are you using? On what operating system?
reaver-1.1: subversion revision 16
ar --version: 2.18.0.20080103
Debian 2.6.26-2-686 #1 SMP Wed Sep 21 04:35:47 UTC 2011 i686 GNU/Linux

Please provide any additional information below.

Can't finish make. Getting following error:
(cd libwps && make)
make[1]: Entering directory `/home/reaver-wps-read-only/src/libwps'
make[1]: `libwps.o' is up to date.
make[1]: Leaving directory `/home/reaver-wps-read-only/src/libwps'
(cd utils && make)
make[1]: Entering directory `/home/reaver-wps-read-only/src/utils'
ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o 
wpa_debug.o wpabuf.o os_unix.o eloop.o
ar: illegal option -- T
Usage: ar [emulation options] [-]{dmpqrstx}[abcfilNoPsSuvV] [member-name] 
[count] archive-file file...
       ar -M [<mri-script]
 commands:
  d            - delete file(s) from the archive
  m[ab]        - move file(s) in the archive
  p            - print file(s) found in the archive
  q[f]         - quick append file(s) to the archive
  r[ab][f][u]  - replace existing or insert new file(s) into the archive
  t            - display contents of archive
  x[o]         - extract file(s) from the archive
 command specific modifiers:
  [a]          - put file(s) after [member-name]
  [b]          - put file(s) before [member-name] (same as [i])
  [N]          - use instance [count] of name
  [f]          - truncate inserted file names
  [P]          - use full path names when matching
  [o]          - preserve original dates
  [u]          - only replace files that are newer than current archive contents
 generic modifiers:
  [c]          - do not warn if the library had to be created
  [s]          - create an archive index (cf. ranlib)
  [S]          - do not build a symbol table
  [v]          - be verbose
  [V]          - display the version number
  @<file>      - read options from <file>
 emulation options: 
  No emulation specific options
ar: supported targets: elf32-i386 a.out-i386-linux efi-app-ia32 elf32-little 
elf32-big elf64-x86-64 efi-app-x86_64 elf64-little elf64-big srec symbolsrec 
tekhex binary ihex trad-core
make[1]: *** [libutils.a] Error 1
make[1]: Leaving directory `/home/reaver-wps-read-only/src/utils'
make: *** [libutils] Error 2

I would appreciate any help, thank you.

While ./configure on Max OS X Lion runs fine, make fails. The first error line 
seems to be
iwlib.h:54:53: warning: linux/types.h: No such file or directory
The full message is at http://pastebin.com/xTGwnR9Y

I can't find anything online about it. Could anyone please try to replicate 
these issues on Mac OS?

Thank you!

I've opened a new ticket for the possible implementation of the WPS mode of the 
tp-link devices.

So I have downloaded the QSS utility for windows, and I have captured the 
succesfull auth.

Then I have done the same with reaver, forcing the build_wps_pin() function to 
use my PIN:

char *build_wps_pin()
{
        char *key = NULL, *pin = NULL;
        int pin_len = PIN_SIZE + 1;

        pin = malloc(pin_len);
        key = malloc(pin_len);
        if(pin && key)
        {
                memset(key, 0, pin_len);
                memset(pin, 0, pin_len);

                /* Generate a 7-digit pin from the given key index values */
                snprintf(key, pin_len, "%s%s", "2020", "656");

                /* Generate and append the pin checksum digit */
                snprintf(pin, pin_len, "%s%d", key, wps_pin_checksum(atoi(key)));

                free(key);
        }
        return pin;
} 

The output that I get is:

Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from F4:EC:38:A0:4F:06
[+] Switching mon0 to channel 9
[+] Associated with F4:EC:38:A0:4F:06 (ESSID: TP-LINK_A04F06)
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous 
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
...etc

PIN:20206567
WPA2/KEY:12345678

I've attached the 2 caps.

If is there anything I can do to help on this issue, let me know.

Best Regards

Starting monitor Mode:

airmon-ng start wlan0

Result of airmon-ng:

wlan0           Realtek RTL8187L        rtl8187 - [phy7]
mon0            Realtek RTL8187L        rtl8187 - [phy7]

Start reaver:
reaver -i mon0 -b 00:18:E7:F9:DF:22

Here comes the Error Message:

Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[-] Failed to initialize interface 'mon0'
[-] Failed to recover WPA key

On Ubuntu, AWUS36NH USB, rtl8187 chipset

What steps will reproduce the problem?
1. ./reaver -i mon0 -b <mac> -vv 
2.
3.

What is the expected output? What do you see instead?
expect several attempts, quits after one.

What version of the product are you using? On what operating system?
svn checkout after Issue: 2. Fedora 16

Please provide any additional information below.

./reaver -i mon0 -b 00:1C:F0:C4:BF:26 -vv

Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner 
<[email protected]>

[+] Waiting for beacon from 00:1C:F0:C4:BF:26
[+] Switching mon0 to channel 10
[+] Associated with 00:1C:F0:C4:BF:26 (ESSID: Test)
[+] Trying pin 22430373
[root@fedora src]$

What steps will reproduce the problem?
1. failed association warnings


What version of the product are you using? On what operating system?
Most current reaver-1.2.tar.gz  Reaver v1.2  

Please provide any additional information below.
I have tried everything from uninstalling and reinstalling. 
I keep getting the failed association error message. Can't figure out what I'm 
doing wrong. I have wifi usb alfa card. Any idea why this would happen? 

What steps will reproduce the problem?
1. bt5 r1 live cd
2. alfa rtl8187

What is the expected output? 
generating different pins. 

What do you see instead?
pin loops. occurring about 4 times every 1% completion.

What version of the product are you using? On what operating system?
r35

Please provide any additional information below.
I have been attempting to use reaver on many different APs with several 
versions of the software and between 32bit 64 bit, VMware, CD, USB. It would be 
great if this software approached the bruteforce sequentially (ie: 0001000, 
0002000) so that if you need to restart an attack you could define your 
starting point and continue where you left of.

In the makefile the rule for wpscrack is incorrect as it hardcodes the 
dependencies but has *.o in the compilation command line.

The practical implication is that it doesn't hardcode pins.o as a dependency so 
even if it's getting modified, the problem is that when pins.c is modified it 
should lead to rebuilding pins.o and reaver but that's not happening.

wpscrack is a target in the makefile that should be called reaver to build the 
reaver executable.




What version of the product are you using? On what operating system? r35

.

What steps will reproduce the problem?
1. compiling and instaling
2. putting the interface into monitor mode
3. attempts with APs

What is the expected output? What do you see instead?
too many timeouts
attemting the same pin
on some APs - failed association

What version of the product are you using? On what operating system?
backtrack gnome 5 r2 with Atheros AR9285 Wireless Network Adapter


Please provide any additional information below.

This is the latest svn ver as of writing!
compiled with all known pre reqs on backtrack 4r2

What steps will reproduce the problem?
1. run reaver with "reaver -i mon0 -b (a "bssid") -vv  
2. did not shutdown possible conflicting programs? 
3. is in monitor mode
4. attempted multiple signal strengths on multiple test routers; ddwrt netgear, 
att, netgear, linksys
5. I'm using a alfa usb card; ralink rt2870/3070 rt2800ush on phy0 / wlan0, 
mon0 and mon1
9i'm not sure of the supported cards atm please post this to wiki
(Rechecked and some report not working I'm reporting it does not)

What is the expected output? What do you see instead?
works?
the program to begin cracking pin.
then successful retreival of pin

What version of the product are you using? On what operating system?
absolute latest!

Please provide any additional information below.

the pids of the programs to shutdown in a list would be a nice addition to the 
script if not already present.

a mac changer.

can we add this to wifite?!?!?!?! That would be awesome!!!!