Brute-Forcing WPS Pins with Reaver in Linux

Last Updated : 8 Aug, 2026

Reaver is an open-source WPS auditing tool for Linux that tests the security of PIN-based WPS authentication on wireless access points. It communicates directly with the WPS registration protocol to determine whether a device is vulnerable to PIN enumeration.

WPS PIN Authentication

Unlike WPA2 authentication, WPS relies on an 8-digit PIN exchanged during the WPS registration process. The protocol validates the PIN in two independent stages:

  • First 4 digits.
  • Last 3 digits (final digit is a checksum).

Working of Reaver

Rather than targeting WPA/WPA2 encryption directly, Reaver communicates with the WPS protocol implemented by the wireless access point.

  • Detecting nearby wireless access points that advertise WPS.
  • Initiating WPS authentication requests.
  • Testing PIN values through repeated protocol exchanges.
  • Monitoring the access point's responses.
  • Determining whether the WPS implementation accepts or rejects authentication attempts.

Brute-Forcing WPS Pins with Reaver in Linux

Brute-Forcing WPS Pins with Reaver in Linux

Reaver is preinstalled on Kali Linux and other Linux security distributions. There is no need to download or install it separately.

Step 1: Configure the Wireless Adapter

Ensure the wireless adapter supports IEEE 802.11 monitor mode and packet injection. Monitor mode allows the adapter to capture and analyze wireless management frames without associating with an access point.

sudo airmon-ng start wlan0

Brute-Forcing WPS Pins with Reaver in Linux

As you can see in the above image wlan0 is now in monitor mode named wlan0mon.

Step 2: Identify WPS-Enabled Access Points

Now we can search for any Access Point which has WPS enabled and it is unlocked. wlan0mon is the wireless interface which is in monitor mode. Type the following command to do so.

sudo wash -i <interface>

Brute-Forcing WPS Pins with Reaver in Linux

You can see the list of APS with WPS versions and whether it's locked or unlocked.

Step 3: Select an Authorized Test Target

Choose only the authorized access point that is within the defined penetration-testing scope. Document its BSSID and wireless configuration before beginning the assessment.

Step 4: Assess the WPS Implementation

Type the following command to run reaver and see all the commands to crack WPS Pin.

reaver -h

Screenshot-from-2023-06-08-23-01-53.png

Step 5: Analyze the Results

Type the following command to run the Brute-Forcing WPS Pins with Reaver.

sudo reaver -i wlan0mon -b 4C:22:F3:FA:60:9D -S -v
  • -i: It states the name of the interface to be used.
  • -b: It states the bssid of the Victim AP.
  • -S: It tells the tool to use small DH (Diffie–Hellman) keys to improve crack speed.
  • -v: It Display non-critical warnings.

Brute-Forcing WPS Pins with Reaver in Linux

Now the tool will try all the possible pins to crack the WPS Pin of the target. Once the correct pin found, It will display it and you can now connect to the network without the password.

Brute-Forcing WPS Pins with Reaver in Linux

Best Practices

  • Never deploy WPS in enterprise environments.
  • Disable unused wireless services.
  • Continuously monitor wireless authentication logs.
  • Audit wireless infrastructure regularly.
  • Replace legacy access points lacking WPS protections.
Comment

Explore