martinxusz / reaver-wps Goto Github PK
View Code? Open in Web Editor NEWAutomatically exported from code.google.com/p/reaver-wps
Automatically exported from code.google.com/p/reaver-wps
What steps will reproduce the problem?
1. installing
2.
3.
What is the expected output? What do you see instead?
root@ubuntu:/home/toor/Bureau/reaver-1.2/src# make install
if [ ! -d /etc/reaver ]; then mkdir /etc/reaver; fi
if [ -e reaver ]; then cp reaver /usr/local/bin/reaver; fi
ln -s /usr/local/bin/reaver /usr/bin/reaver
What version of the product are you using? On what operating system?
Ubuntu11.04
Please provide any additional information below.
Please can you help me
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 5:57
Hello guys,
I know some routers have default pin numbers (12345670 for instance). I was
wondering if it was possible to add an option to reaver-wps that would allow
the user to manually specify a pin number to try.
Thank you very much !
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 10:36
Is it possible to work in many threads, so speeding up the bruteforce process?
Original issue reported on code.google.com by [email protected]
on 2 Jan 2012 at 5:46
What steps will reproduce the problem?
1. Run reaver, let it do it's thing
2. If for some reason it's been through the whole list of possibilities, it
will continue looping the last pin
One of these scenarios is bug #12
What is the expected output? What do you see instead?
After the list of possible pincodes is exhausted, i expect Reaver to give me
feedback, ie.: First part cracked:, couldn't crack 2nd part.
This is not the case, instead it keeps on going with the last pincode and never
reaches 100%:
+] Trying pin 47702738
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[+] Trying pin 47703889
[!] WARNING: Receive timeout occurred
[+] 99.99% complete @ 2 seconds/attempt
[+] Trying pin 47703889
etc.
What version of the product are you using? On what operating system?
v16 SVN
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 12:44
What steps will reproduce the problem?
1. Everytime I start the bruteforce. I changed the AP, same problem :(
2.
3.
What is the expected output? What do you see instead?
- Changing keys in every line.
- Always the same is tested.
What version of the product are you using? On what operating system?
- BT5 R1 RT3070
- Reaver 1.2 rv35
Please provide any additional information below.
Reaver v1.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from 88:25:2C:52:67:63
[+] Switching mon0 to channel 6
[+] Associated with 88:25:2C:52:67:63 (ESSID: WLAN-F58613)
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[+] Trying pin 57245515
[!] WARNING: Receive timeout occurred
[!] WARNING: 10 failed connections in a row
[+] Trying pin 57245515
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 57245515
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 1:45
What steps will reproduce the problem?
1. run reaver as usuall
2. bruteforce the PIN
3. reaver guesses the right PIN and outputs the WPA PSK
What is the expected output? What do you see instead?
Expected output is the WPA passphrase or WPA PSK needed for auth with AP.
After a valid PIN is tested reaver reports wrong PSK key, and when run against
the same AP , reports a different one.
What version of the product are you using? On what operating system?
1.1 on 2.6 linux with ath5k
Please provide any additional information below.
not sure if this is some sort of a bug in reaver or it's just that my AP is
generating per client WPA PSK . If that is the case, any idea how to actually
get the passphrase/PSK?
Note that reaver get the RIGHT PIN (i actually hardcoded it for testing )
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 4:58
>What steps will reproduce the problem?
1. Initialize Reaver normally.
2. Press the 'WPS' Button (hard or soft) on the AP
>What is the expected output? What do you see instead?
Expected nothing.
Program Returns:
[+] Trying pin 42616139
[+] Key cracked in 2155 seconds
[+] WPS PIN: '42616139'
Cracked PIN is not the AP PIN number, the PIN that was being tested when the AP
WPS button was pressed, would make sense, as the AP allows a different type of
PIN check when pressing its WPS button, either on the device itself or the
admin webpage, the admin webpage of the AP tested lists its own PIN, which is
different from the cracked PIN in this case.
>What version of the product are you using? On what operating system?
--Reaver1.0
--Ubuntu11.10
--WAG120N AP
>Please provide any additional information below.
I'm not sure exactly how this program works, though I can assume the engine for
cracking uses the NACK to determine failure, if there is no NACK at the end of
the handshake does the program assume success and stop with a PIN it thinks is
correct?
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 7:38
I am using reaver on a Fedora 16 install..
#uname -a
Linux Fedora16 3.1.5-6.fc16.i686.PAE #1 SMP Thu Dec 15 16:19:31 UTC 2011 i686
i686 i386 GNU/Linux
The network card I am using is an Alfa Wireless AWUS035H
I grab the BSSIS from the following
# islist wlan0
Cell 01 - Address: 00:22:3F:39:3B:78
Channel:11
Frequency:2.462 GHz (Channel 11)
Quality=43/70 Signal level=-67 dBm
Encryption key:on
ESSID:"burp"
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
12 Mb/s; 24 Mb/s; 36 Mb/s
Bit Rates:9 Mb/s; 18 Mb/s; 48 Mb/s; 54 Mb/s
Mode:Master
Extra:tsf=000000c54f399c7f
Extra: Last beacon: 80ms ago
IE: Unknown: 000462757270
IE: Unknown: 010882848B960C183048
IE: Unknown: 03010B
IE: Unknown: 2A0100
IE: Unknown: 32041224606C
IE: WPA Version 1
Group Cipher : TKIP
Pairwise Ciphers (1) : TKIP
Authentication Suites (1) : PSK
# reaver -i wlan0 -b 00:22:3F:39:3B:78 -vv
Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from 00:22:3F:39:3B:78
After waiting an hour it never did anything else.
Thanks for the hard work!
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 8:58
In the makefile the rule for wpscrack is incorrect as it hardcodes the
dependencies but has *.o in the compilation command line.
The practical implication is that it doesn't hardcode pins.o as a dependency so
even if it's getting modified, the problem is that when pins.c is modified it
should lead to rebuilding pins.o and reaver but that's not happening.
wpscrack is a target in the makefile that should be called reaver to build the
reaver executable.
What version of the product are you using? On what operating system? r35
.
Original issue reported on code.google.com by [email protected]
on 2 Jan 2012 at 10:33
What steps will reproduce the problem?
1. failed association warnings
What version of the product are you using? On what operating system?
Most current reaver-1.2.tar.gz Reaver v1.2
Please provide any additional information below.
I have tried everything from uninstalling and reinstalling.
I keep getting the failed association error message. Can't figure out what I'm
doing wrong. I have wifi usb alfa card. Any idea why this would happen?
Original issue reported on code.google.com by [email protected]
on 2 Jan 2012 at 4:13
Attachments:
What steps will reproduce the problem?
1. ./configure worked fine
2. make throws error: ar: illegal option -- T
3. make exits with errors
What version of the product are you using? On what operating system?
reaver-1.1: subversion revision 16
ar --version: 2.18.0.20080103
Debian 2.6.26-2-686 #1 SMP Wed Sep 21 04:35:47 UTC 2011 i686 GNU/Linux
Please provide any additional information below.
Can't finish make. Getting following error:
(cd libwps && make)
make[1]: Entering directory `/home/reaver-wps-read-only/src/libwps'
make[1]: `libwps.o' is up to date.
make[1]: Leaving directory `/home/reaver-wps-read-only/src/libwps'
(cd utils && make)
make[1]: Entering directory `/home/reaver-wps-read-only/src/utils'
ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o
wpa_debug.o wpabuf.o os_unix.o eloop.o
ar: illegal option -- T
Usage: ar [emulation options] [-]{dmpqrstx}[abcfilNoPsSuvV] [member-name]
[count] archive-file file...
ar -M [<mri-script]
commands:
d - delete file(s) from the archive
m[ab] - move file(s) in the archive
p - print file(s) found in the archive
q[f] - quick append file(s) to the archive
r[ab][f][u] - replace existing or insert new file(s) into the archive
t - display contents of archive
x[o] - extract file(s) from the archive
command specific modifiers:
[a] - put file(s) after [member-name]
[b] - put file(s) before [member-name] (same as [i])
[N] - use instance [count] of name
[f] - truncate inserted file names
[P] - use full path names when matching
[o] - preserve original dates
[u] - only replace files that are newer than current archive contents
generic modifiers:
[c] - do not warn if the library had to be created
[s] - create an archive index (cf. ranlib)
[S] - do not build a symbol table
[v] - be verbose
[V] - display the version number
@<file> - read options from <file>
emulation options:
No emulation specific options
ar: supported targets: elf32-i386 a.out-i386-linux efi-app-ia32 elf32-little
elf32-big elf64-x86-64 efi-app-x86_64 elf64-little elf64-big srec symbolsrec
tekhex binary ihex trad-core
make[1]: *** [libutils.a] Error 1
make[1]: Leaving directory `/home/reaver-wps-read-only/src/utils'
make: *** [libutils] Error 2
I would appreciate any help, thank you.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 11:58
What steps will reproduce the problem?
1. compiling and instaling
2. putting the interface into monitor mode
3. attempts with APs
What is the expected output? What do you see instead?
too many timeouts
attemting the same pin
on some APs - failed association
What version of the product are you using? On what operating system?
backtrack gnome 5 r2 with Atheros AR9285 Wireless Network Adapter
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 2 Jan 2012 at 11:04
Is there a way to detect if an AP has WPS support? If so it would be helpful if
Reaver told you this and exited if support was not found.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 2:53
What steps will reproduce the problem?
1. reaver -i wlan0 -b XX:XX:XX:XX:XX:XX
What is the expected output? What do you see instead?
Reaver hangs on "Waiting for beacon from XX:XX:XX:XX:XX:XX". It is not a range
problem, I am able to wirelessly connect to the router using the PSK. It always
hangs on this message on all 3 routers I have tried.
What version of the product are you using? On what operating system?
ver: reaver rev 22
os: fedora 16
wifi: Ralink corp. RT2860 (Device 2790)
driver: rt2800pci
Please provide any additional information below.
Specifying essid and using -c and -f does not cure the problem, -vv provides no
more information. Hangs for 5 minutes, still waiting.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 3:20
What steps will reproduce the problem?
1. executing reaver with given example usage
2.
3.
What is the expected output? What do you see instead?
Does not work with my driver apparently...
[-] Failed to initialize interface 'wlan0'
[-] Failed to recover WPA key
What version of the product are you using? On what operating system?
reaver v1.1
3.1.5 Kernel
ArchLinux x86_64
Please provide any additional information below.
Have tried both iwconfig and airmon-ng and verified my card is in monitor mode
and ready for action but no love... I know my card supports injection etc. but
for some odd reason reaver doesn't like it.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 7:12
This tool would be even more awesome if it could dodge lockdowns !
What about changing mac adress by each try to maybe dodge the security used by
most newer routers ?
Regards from NeZZeR.
Keep up the good work and make it seen at the backtrack forums !
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 3:30
A few minutes into the attack, Reaver detects rate limiting. After about 20
minutes it is still detecting rate limiting.
However, if I quit Reaver and restart the attack, it will start trying pins
again successfully.
Ubuntu 11.10 64 bit
rtl8187
Reaver r20
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 4:09
While ./configure on Max OS X Lion runs fine, make fails. The first error line
seems to be
iwlib.h:54:53: warning: linux/types.h: No such file or directory
The full message is at http://pastebin.com/xTGwnR9Y
I can't find anything online about it. Could anyone please try to replicate
these issues on Mac OS?
Thank you!
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 1:20
In the case the pin is already known and the key has been changed, it would be
convenient to be able to specify the pin so the key can be retrieved instantly.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 4:10
What steps will reproduce the problem?
1. Start reaver specifying -i and -b
2. The pin usually gets 'stuck', repeating the same one
What is the expected output?
Continuously changing pin.
What do you see instead?
The same pin repeated.
What version of the product are you using? On what operating system?
1.1 on linux, kernel 2.6.38 using ath9k
Please provide any additional information below.
None at this time.
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 10:21
What steps will reproduce the problem?
1. Start reaver specifying -c
2. Program returns immediately
3.
What is the expected output? What do you see instead?
Expected to not channel hop and lock to channel specified by -c
Program returns immediately
What version of the product are you using? On what operating system?
1.1 on linux 2.6.38
Please provide any additional information below.
Program seems to find the channel if -c is not specified and begins the attack.
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 10:26
BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.
~ $ root
BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.
Nokia-N900:~# cd trunk/src/
Nokia-N900:~/trunk/src# ./configure
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for pcap_open_live in -lpcap... yes
configure: creating ./config.status
config.status: creating Makefile
Nokia-N900:~/trunk/src#
BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.
~ $ root
BusyBox v1.10.2 (Debian 3:1.10.2.legal-1osso30+0m5) built-in shell (ash)
Enter 'help' for a list of built-in commands.
Nokia-N900:~# cd trunk/src/
Nokia-N900:~/trunk/src# make
(cd libwps && make)
make[1]: Entering directory `/root/trunk/src/libwps'
make[1]: `libwps.o' is up to date.
make[1]: Leaving directory `/root/trunk/src/libwps'
(cd utils && make)
make[1]: Entering directory `/root/trunk/src/utils'
Makefile:36: no file name for `-include'
ar crT libutils.a base64.o common.o ip_addr.o radiotap.o trace.o uuid.o
wpa_debug.o wpabuf.o os_unix.o eloop.o
ar: illegal option -- T
Usage: ar [emulation options] [-]{dmpqrstx}[abcfilNoPsSuvV] [member-name]
[count] archive-file file...
ar -M [<mri-script]
commands:
d - delete file(s) from the archive
m[ab] - move file(s) in the archive
p - print file(s) found in the archive
q[f] - quick append file(s) to the archive
r[ab][f][u] - replace existing or insert new file(s) into the archive
t - display contents of archive
x[o] - extract file(s) from the archive
command specific modifiers:
[a] - put file(s) after [member-name]
[b] - put file(s) before [member-name] (same as [i])
[N] - use instance [count] of name
[f] - truncate inserted file names
[P] - use full path names when matching
[o] - preserve original dates
[u] - only replace files that are newer than current archive contents
generic modifiers:
[c] - do not warn if the library had to be created
[s] - create an archive index (cf. ranlib)
[S] - do not build a symbol table
[v] - be verbose
[V] - display the version number
@<file> - read options from <file>
emulation options:
No emulation specific options
ar: supported targets: elf32-littlearm elf32-bigarm elf32-little elf32-big srec
symbolsrec tekhex binary ihex
make[1]: *** [libutils.a] Error 1
make[1]: Leaving directory `/root/trunk/src/utils'
make: *** [libutils] Error 2
Nokia-N900:~/trunk/src#
What is the expected output? What do you see instead?
What version of the product are you using? On what operating system?
r35
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 7:18
What steps will reproduce the problem?
1. Run reaver, crack first 4 digits and let the program continue.
2. At some point it will try:
[+] Trying pin 47704244
[!] WARNING: Receive timeout occurred
However, this is the correct pin, but due to a timeout, it is skipped, not
repeated?
What is the expected output? What do you see instead?
I see that it continues to crack other pins, but not repeating the correct one.
I believe it's supposed to retry the pins that encountered a timeout.
What version of the product are you using? On what operating system?
latest svn checkout (v16)
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 12:30
running bt5 rc 32, reaver 1.2 (no svn update)
this is what I get on 3 differents access point:
reaver -i mon0 -b 00:14:D1:50:8E:46
Reaver v1.2 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from 00:14:D1:50:8E:46
[+] Associated with 00:14:D1:50:8E:46 (ESSID: house)
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
[+] 0.00% complete @ 0 seconds/attempt
........
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 1:58
What steps will reproduce the problem?
1. Start reaver (reaver -i mon0 -b *BSSID* -c 11 -vv)
2. Wait for it to associate and try one pin.
3. Receive the error
What is the expected output? What do you see instead?
[+] Waiting for beacon from 00:1D:7E:B5:0C:66
[+] Switching mon0 to channel 11
[+] Associated with *BSID* (ESSID: net)
[+] Trying pin 86274814
Clearly the above is OK but after it tries the following it constantly outputs
the follow.
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous
message
What version of the product are you using? On what operating system?
Reaver 1.1 in Backtrack 4 R2
Alfa AWUS036NH with rt2800usb
Linksys WAG160N
Please provide any additional information below.
Sorry if this has already been discussed however I could not find mention of it
in other bug reports. Many thanks.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 12:38
This is the latest svn ver as of writing!
compiled with all known pre reqs on backtrack 4r2
What steps will reproduce the problem?
1. run reaver with "reaver -i mon0 -b (a "bssid") -vv
2. did not shutdown possible conflicting programs?
3. is in monitor mode
4. attempted multiple signal strengths on multiple test routers; ddwrt netgear,
att, netgear, linksys
5. I'm using a alfa usb card; ralink rt2870/3070 rt2800ush on phy0 / wlan0,
mon0 and mon1
9i'm not sure of the supported cards atm please post this to wiki
(Rechecked and some report not working I'm reporting it does not)
What is the expected output? What do you see instead?
works?
the program to begin cracking pin.
then successful retreival of pin
What version of the product are you using? On what operating system?
absolute latest!
Please provide any additional information below.
the pids of the programs to shutdown in a list would be a nice addition to the
script if not already present.
a mac changer.
can we add this to wifite?!?!?!?! That would be awesome!!!!
Original issue reported on code.google.com by [email protected]
on 1 Jan 2012 at 5:08
What steps will reproduce the problem?
1. Linksys WRT54G/GL/GS with Firmware: DD-WRT v24-sp2 (10/10/09) mini
2. airodump-ng mon0
3. Cancel airdump-ng and copy target bssid
3. reaver -i mon0 -b 00:01:02:03:04:05 -c 6 -vv
What is the expected output? What do you see instead?
After getting a beacon frame it gets associated but never starts the pin tries.
What version of the product are you using? On what operating system?
Backtrack 5r1 64bit
Please provide any additional information below.
Researching DD-WRT's site it was revealed that DD-WRT DOES NOT support WPS and
configured the WPS button to work as a Reset Button
Original issue reported on code.google.com by [email protected]
on 1 Jan 2012 at 5:56
What steps will reproduce the problem?
Hardware - ALFA AWUS036H
Running the following command within Reaver
reaver -i mon0 -b *AP MAC*
What is the expected output? What do you see instead?
The expected output is association with the target AP. Instead I receive the
following
http://pastebin.com/KAYwGWs0
What version of the product are you using? On what operating system?
Reaver-1.0
Backtrack 5
Please provide any additional information below.
I am able to associate with the AP using Aireplay-ng, but Reaver is unable to
do so.
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 6:49
I compiled the code in openwrt build tree. It does compile and seems to run.
Although the code does now compile using this makefile it does not run properly.
It does start hopping the channels but never associates.
Please find a copy of the makefile :-
#
# Copyright (C) 2012 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
PKG_NAME:=reaver-wps
PKG_REV:=35
PKG_VERSION:=r$(PKG_REV)
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
PKG_SOURCE_PROTO:=svn
PKG_SOURCE_URL:=http://reaver-wps.googlecode.com/svn/trunk/src
PKG_SOURCE_VERSION:=$(PKG_REV)
include $(INCLUDE_DIR)/package.mk
define Package/reaver-wps
SECTION:=net
CATEGORY:=Network
SUBMENU:=wireless
TITLE:=Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs
URL:=http://code.google.com/p/reaver-wps/
DEPENDS:=+libpcap
endef
define Package/reaver-wps/description
Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2
passphrases, as described in http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf .
endef
TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/
define Build/Prepare
$(call Build/Prepare/Default)
# sed -i 's/Q=@/Q=/' $(PKG_BUILD_DIR)/common/lib.rules
sed -i 's/$$$$(CC)/$$$$(CC) $$$$(CFLAGS)/' $(PKG_BUILD_DIR)/wps/Makefile
sed -i 's/CC=gcc/CC?=gcc/' $(PKG_BUILD_DIR)/libwps/Makefile
sed -i 's/CFLAGS=/CFLAGS+=/' $(PKG_BUILD_DIR)/libwps/Makefile
sed -i 's/CC = gcc/CC ?= gcc/' $(PKG_BUILD_DIR)/lwe/Makefile
sed -i 's/AR = ar/AR ?= ar/' $(PKG_BUILD_DIR)/lwe/Makefile
sed -i 's/RANLIB = ranlib/RANLIB ?= ranlib/' $(PKG_BUILD_DIR)/lwe/Makefile
sed -i 's/CFLAGS=/CFLAGS+=/' $(PKG_BUILD_DIR)/lwe/Makefile
endef
define Package/reaver-wps/install
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_BUILD_DIR)/reaver $(1)/usr/sbin/
endef
$(eval $(call BuildPackage,reaver-wps))
http://paste.debian.net/150669/
What version of the product are you using? On what operating system? r35
Original issue reported on code.google.com by [email protected]
on 1 Jan 2012 at 9:58
Attachments:
running latest stable ubuntu 64,
reaver -i $dev -b $ssid always segfaults
backtrace:
#0 0x000000000041290a in wps_registrar_expire_pins (reg=0x0) at
wps_registrar.c:559
#1 0x0000000000412a83 in wps_registrar_get_pin (reg=0x0, uuid=0x6cf724 "",
pin_len=0x7fffffffdf90) at wps_registrar.c:600
#2 0x0000000000413909 in wps_get_dev_password (wps=0x6cf700) at
wps_registrar.c:1000
#3 0x000000000041558f in wps_registrar_get_msg (wps=0x6cf700,
op_code=0x7fffffffe014) at wps_registrar.c:1615
#4 0x0000000000407bfc in send_msg () at send.c:80
#5 0x0000000000405c18 in do_wps_exchange () at exchange.c:66
#6 0x00000000004057b1 in crack () at cracker.c:160
#7 0x00000000004027a8 in main (argc=6, argv=0x7fffffffe1d8) at wpscrack.c:80
as you can see reg is 0
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 11:23
>What steps will reproduce the problem?
Normal usage to an AP 1M away from my adaptor
>What is the expected output? What do you see instead?
Expected o/p is rorating PIN Until successful completion. What I see is the PIN
will change for about 1 minute and then get stuck on the same PIN.AP is a
Netgear WNR2200
>What version of the product are you using? On what operating system?
--reaver 1.2 (no SVN updates)
--Ubuntu 11.10 64-bit
--Alpha AWUS036H USB adaptor
>Please provide any additional information below.
pcap file attached.I was getting the segmentation fault but this has
dissapeared.THis may be a localised AP issue as on other AP's with very good
RSSI, I dont get the "stuck" PIN but what I do get are/is very frequent
timeouts.I will raise this on a seperate ticket?
Great tool, BTW.I'm a bot of a noob when it comes to LInux but very interested
in wireless.Anything else you need, just let me know.
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 8:47
Attachments:
What steps will reproduce the problem?
1. ./reaver -i mon0 -b <mac> -vv
2.
3.
What is the expected output? What do you see instead?
expect several attempts, quits after one.
What version of the product are you using? On what operating system?
svn checkout after Issue: 2. Fedora 16
Please provide any additional information below.
./reaver -i mon0 -b 00:1C:F0:C4:BF:26 -vv
Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from 00:1C:F0:C4:BF:26
[+] Switching mon0 to channel 10
[+] Associated with 00:1C:F0:C4:BF:26 (ESSID: Test)
[+] Trying pin 22430373
[root@fedora src]$
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 3:30
What steps will reproduce the problem?
1. Attack Vodafone EasyBox 803 (or probably any device manufactured by arcadyan
with wps-pin)
2. Sniff with Wireshark whats happening
What is the expected output?
It's expectet that your tool iterates through the pins
What do you see instead?
It does not iterate through the pins, instead:
---------------------
root@fuckup:src $ ./reaver -i mon0 -b 7C:4F:B5:C8:64:09 -vv
Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from 7C:4F:B5:C8:64:09
[+] Switching mon0 to channel 1
[+] Associated with 7C:4F:B5:C8:64:09 (ESSID: EasyBox-C86429)
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 52941009
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[!] WARNING: 10 failed connections in a row
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] Trying pin 52941009
[!] WARNING: Receive timeout occurred
[+] 0.00% complete @ 0 seconds/attempt
---------------------
What version of the product are you using?
SVN Version of today
On what operating system?
BackTrack 5R1 x85 KDE
Please provide any additional information below.
Packet-Dump is attached.
I use the alfa awus036h with the rtl8187 chipset (as you do)
I looked into the dump allready together with Stefan Viehboeck and he is of the
opintion that this "WPS, MD2" packet in the EAP-packets should normally not be
there.
I am pretty sure it should work since i can log in with wps-pin from windows7
into the device. That device is also the one which got Stefan initially started
to research the problem. Would be great if you could take a look into the dump.
cya
Original issue reported on code.google.com by S3M73X
on 29 Dec 2011 at 10:55
Attachments:
What steps will reproduce the problem?
1. Loaded VMWARE Aircrack distro
2. Run configure and make
3. fails with plib requirements
What is the expected output? What do you see instead?
Successful install instead plib fails requiring gl
What version of the product are you using? On what operating system?
1.1
Please provide any additional information below.
Does the install require GL video card?
Original issue reported on code.google.com by [email protected]
on 1 Jan 2012 at 6:09
What steps will reproduce the problem?
Does not compile on Mac OS X
What is the expected output? What do you see instead?
Success
What version of the product are you using? On what operating system?
10.6 OS X
Please provide any additional information below.
Anyone up for porting it to Mac OS X and *BSD?
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 10:27
What steps will reproduce the problem?
1. updated from r32 to r33
2. ran reaver
3.
What is the expected output? What do you see instead?
with r32 i was getting about 2 seconds/attempt with random timeouts. r33 is
getting mostly timeouts and slowed to 10-20 seconds/attempt.
reverting to r32 solved issue.
What version of the product are you using? On what operating system?
bt5
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 2:33
Moved from issue #2:
Comment 20 by gorilla.maguila, Today (43 minutes ago)
This is what I get with latest subversion:
[+] Waiting for beacon from C0:3F:0E:C1:DB:A7
[+] Switching mon0 to channel 2
[+] Switching mon0 to channel 4
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7
[+] Associated with C0:3F:0E:C1:DB:A7
[+] Trying pin 90553301
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7
[+] Switching mon0 to channel 3
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
Segmentation fault
I'm under kernel 3.1.5 with iwlagn driver
Comment 21 by project member [email protected], Today (33 minutes ago)
maguila,
I have not tested the iwlagn drivers, but since you were able to associate I'd
suspect that injection is working properly. The failed associations and receive
timeouts are usually an indication of poor signal strength or a lot of wireless
interference.
The segfault is troubling though. Can you give more info on your OS ?
Comment 22 by gorilla.maguila, Today (12 minutes ago)
I'm using Archlinux x64. We use almost the latest packages on everything as it
is a rolling release distro.
I have tried to run under gdb but I don't know why I don't get the segmentation
fault:
$gdb ./reaver
GNU gdb (GDB) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/user/reaver-wps-read-only/src/reaver...done.
(gdb) run -i mon0 -b C0:3F:0E:C1:DB:A7 -vv
Starting program: /home/user/reaver-wps-read-only/src/reaver -i mon0 -b
C0:3F:0E:C1:DB:A7 -vv
Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from C0:3F:0E:C1:DB:A7
[+] Switching mon0 to channel 4
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Associated with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Trying pin 26141367
[!] WARNING: Failed to associate with C0:3F:0E:C1:DB:A7 (ESSID: ONODBA7)
[+] Switching mon0 to channel 2
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
[!] WARNING: Receive timeout occurred
...etc
But again I get the segmentation fault without gdb.
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 3:36
---
./reaver --help
Reaver v1.0 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<cheffner@tacnetso
l.com>
Segmentation fault
---
want me to recompile with symbols and run it with gdb ?
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 7:06
There is some litle video:
http://www.youtube.com/user/MaurisTechChannel
( 1st Video at his Channel )
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 3:44
What steps will reproduce the problem?
1. Open reaver-1.2.tar.gz on android file explorer.
What is the expected output? What do you see instead?
Hacking WPA/WPA2 everywhere!
What version of the product are you using? On what operating system?
reaver-1.2.tar.gz on Android 2.3.7
Please provide any additional information below.
Is breaking wpa/wpa2 everywhere on our android device will not be great?
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 1:49
Would it be possible for reaver to store somewhere in a database/text file what
PINs were already tested against which BSSID?
for example when you are testing PINs on a remote location and suddenly you
have to leave and it didn't crack the PIN yet.
Next time you come there, would it be possible to resume instead of starting
from beginning?
some assumptions needed:
PIN did not change in a mean time
??? anything else is required ???
would it be technically possible?
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 8:24
What steps will reproduce the problem?
1. bt5 r1 live cd
2. alfa rtl8187
What is the expected output?
generating different pins.
What do you see instead?
pin loops. occurring about 4 times every 1% completion.
What version of the product are you using? On what operating system?
r35
Please provide any additional information below.
I have been attempting to use reaver on many different APs with several
versions of the software and between 32bit 64 bit, VMware, CD, USB. It would be
great if this software approached the bruteforce sequentially (ie: 0001000,
0002000) so that if you need to restart an attack you could define your
starting point and continue where you left of.
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 5:42
Currently, only Linux platform is supported.
How difficult would it be to port reaver-wps to OS X?
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 9:35
Starting monitor Mode:
airmon-ng start wlan0
Result of airmon-ng:
wlan0 Realtek RTL8187L rtl8187 - [phy7]
mon0 Realtek RTL8187L rtl8187 - [phy7]
Start reaver:
reaver -i mon0 -b 00:18:E7:F9:DF:22
Here comes the Error Message:
Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[-] Failed to initialize interface 'mon0'
[-] Failed to recover WPA key
On Ubuntu, AWUS36NH USB, rtl8187 chipset
Original issue reported on code.google.com by [email protected]
on 29 Dec 2011 at 3:50
What steps will reproduce the problem?
1. run reaver: "reaver -i mon0 -b xx:xx:xx:xx:xx:xx -vv -c 1"
2. wait until message appears "[!] WARNING: Detected AP rate limiting, waiting
315 seconds before re-trying"
What is the expected output? What do you see instead?
After waiting 315 seconds the attack should resume. Instead reaver is waiting
another 315 seconds; over and over again.
What version of the product are you using? On what operating system?
I am using Backtrack 5 R1 and reaver r22, b43 driver
Please provide any additional information below.
The attack works until 0.25% is reached,
[+] 0.25% complete @ 3 seconds/attempt
then reaver waits forever to resume,
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
[!] WARNING: Detected AP rate limiting, waiting 315 seconds before re-trying
even though I am able to cancel the attack, immediately restart it and then it
works again until ca. 0.25% is reached.
Router is "Netgear WNDR3400".
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 4:06
What is the expected output? What do you see instead?
6.34% completed; got 90.93% complete.
What version of the product are you using? On what operating system?
Rev 26, Backtrack 5 x32
Please provide any additional information below.
http://i.imgur.com/F1LO2.png
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 7:42
It happened to me that the first 4 digits were already cracked, and it was
coming down to the last section (3 digits + checksum). But then the AP
disappeared/crashed etc.
I would like to tell the program to use the first 4 digits of the pin that i
have previously obtained for further cracking.
Sounds like a small addition, and could be very useful.
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 12:13
I've opened a new ticket for the possible implementation of the WPS mode of the
tp-link devices.
So I have downloaded the QSS utility for windows, and I have captured the
succesfull auth.
Then I have done the same with reaver, forcing the build_wps_pin() function to
use my PIN:
char *build_wps_pin()
{
char *key = NULL, *pin = NULL;
int pin_len = PIN_SIZE + 1;
pin = malloc(pin_len);
key = malloc(pin_len);
if(pin && key)
{
memset(key, 0, pin_len);
memset(pin, 0, pin_len);
/* Generate a 7-digit pin from the given key index values */
snprintf(key, pin_len, "%s%s", "2020", "656");
/* Generate and append the pin checksum digit */
snprintf(pin, pin_len, "%s%d", key, wps_pin_checksum(atoi(key)));
free(key);
}
return pin;
}
The output that I get is:
Reaver v1.1 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner
<[email protected]>
[+] Waiting for beacon from F4:EC:38:A0:4F:06
[+] Switching mon0 to channel 9
[+] Associated with F4:EC:38:A0:4F:06 (ESSID: TP-LINK_A04F06)
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
[!] WARNING: Last message not processed properly, reverting state to previous
message
[!] Warning: Out of order packet received, re-trasmitting last message
Trying pin 20206567
...etc
PIN:20206567
WPA2/KEY:12345678
I've attached the 2 caps.
If is there anything I can do to help on this issue, let me know.
Best Regards
Original issue reported on code.google.com by [email protected]
on 30 Dec 2011 at 9:51
Attachments:
What steps will reproduce the problem?
1. Download source
2. Unzip
3. ./configure
4. make - fails
What is the expected output? What do you see instead?
Expected output is a successful 'make'.
I see many errors halfway through the make compile:
iwlib.c:2661: warning: (near initialization for ‘standard_event_descr[8]’)
iwlib.c:2662: error: unknown field ‘max_tokens’ specified in initializer
iwlib.c:3002: error: ‘iwstats’ has no member named ‘qual’
iwlib.c:3011: error: ‘struct iw_event’ has no member named ‘u’
iwlib.c:3080: error: ‘union iwreq_data’ has no member named ‘data’
iwlib.c:3096: error: request for member ‘length’ in something not a
structure or union
etc.
What version of the product are you using?
reaver1.2
On what operating system?
MacOSX Lion
Please provide any additional information below.
Original issue reported on code.google.com by [email protected]
on 1 Jan 2012 at 8:59
What steps will reproduce the problem?
1. start in verbose mode and pick any mac...
The software is displaying which channels it is hopping but always skips the
first channel.
Thanks and regards,
Boris
Original issue reported on code.google.com by [email protected]
on 31 Dec 2011 at 12:50
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.