[Cheshire]

Hello everyone,

When using Reaver, am I correct in assuming you must target an AP that is WPS locked? Since Reaver cracks the pin for WPS, if you're trying to crack into an AP that is *not* WPS locked, wouldn't it then not work?

Also, I know if you're doing dictionary attacks on a router, once you've captured the handshake you no longer need to be connected to that router to use aircrack-ng on it (so you can crack this on your own time from your home rather than be sitting out somewhere). Is the same true for Reaver? Or do you need to be connected to it the entire time Reaver is running?

Thanks in advance for helping the n00b!

[Snipa]

reaver works if the AP is vulnerable to the pin bruteforce attack, sometimes work even if wps is turned off.

you can continue the dictionary attack offline using aircrack

you cannot continue the attack offline using reaver, since the attack is continuously interacting with the router.

[Cheshire]

reaver works if the AP is vulnerable to the pin bruteforce attack, sometimes work even if wps is turned off.

you can continue the dictionary attack offline using aircrack

you cannot continue the attack offline using reaver, since the attack is continuously interacting with the router.

Ah, ok, thank you!

So is there a way to check to see if the AP is vulnerable to reaver attack? I know you can use

Code:

wash -i mon0

to see if it is WPS locked. Or is that not relevant?

[Snipa]

i usually start the attack
if it works, i keep it
if not, move to another one.

[Cheshire]

Awesome, thank you so much, @Snipa!

[Snipa]

You are welcome
-Marked as solved-

[kankucho]

why do I get always "Failed to associate with ….." ?? Reaver doesn't work anymore?

[DestructoSphere]

I have 2 methods to check if WPS is enabled. my phone automaticaly queries and tells me or i run fern gui on kali and that also tells me although i dont like fern when there are a lot of aps around because it doesnt show them all. it will tell me they are there but i cant analyse them