aimmit / reaver-wps-fork Goto Github PK

What are the changes and enhancements in this version?

reaver -i mon0 -b 00:14:D1:E6:19:2C -vv -c 11

...

[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received M3 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] Trying pin 12340033.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12340033.
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received M3 message
[+] Sending WSC NACK
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x03), re-trying last pin
[+] 91.02% complete. Elapsed time: 0d0h3m32s.
Floating point exception (core dumped)

after update libpcap to 1.5.3 or 1.6.0 git ..wash stop works.

using reaver 1.5 revision8

This is not a bug, but rather a suggestions.

If I understand correctly: if there is something wrong with the checksum digit 
(the old 99% problem or the problem of checking the same pin over and over 
again), this version of reaver then switches to an alternative approach by 
brute-forcing the last 4 digits (including the checksum digit).

This alternative brute-forcing can take a very long time and it seems that this 
state is never saved to the session file. I've already tried to brute force 4 
times and there is always something going wrong (like the router went offline). 
In this case you have to restart the alternative brute-force from scratch.

My suggestion: is it possible to save all the brute-force (from the alternative 
approach) number that were already checked to file? And/or provide another flag 
to tell reaver to start from a certain pin (this is possible with the 
traditional checksum brute-force, but doesn't work for the alternative 
approach).

In kernels 3.14.x or newer 3.15 , wash see rssi 00  whit drivers ath9k , and 
ath9k_htc
rest of chipsets works fine.


reaver-1.5 revision 8

i thin libpcap not problem because i test 1.3.0 , 1.4.0  & 1.5.0 recompiling 
wash after all, and same 00 in rssi,


rssi function wash changed in newer kernels for ath9k & ath9k_htc  (i think)



you can see same effect on reaver 1.4 in kali linux 1.0.7

There are endless open bugs on the original reaver.

https://code.google.com/p/reaver-wps/issues/detail?id=149


This one seems to affect me as well. (But I have also new bugs... ;-)