offensive-wps
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.
npx skills add SnailSploit/Claude-Red --skill offensive-wps --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# WPS PIN Attacks WPS converts an 8-digit PIN into the network PSK via the M3/M4 message exchange. The PIN is split into 4-digit + 3-digit halves (the 8th digit is a checksum), giving only 11,000 effective combinations — and on vulnerable chipsets, the offline Pixie Dust attack recovers the PIN in seconds without ever sending an online attempt. ## Quick Workflow 1. Detect WPS-enabled APs (look for the WPS IE in beacons) 2. Try Pixie Dust first — offline, undetectable, instantaneous when it works 3. If chipset isn't vulnerable, check whether online brute is feasible (lockout policy) 4. Online brute as last resort, slow and detectable --- ## Detection ```bash # wash — dedicated WPS scanner sudo wash -i wlan0mon # Or use airodump-ng with WPS column sudo airodump-ng wlan0mon --wps ``` Output includes: WPS version (1.0 / 2.0), Locked status, Configured/Unconfigured, vendor. WPS 2.0 introduced lockout enforcement, but many consumer APs still implement it as "lock for 60 seconds after 3 failures" — easily bypassed by waiting. ## Pixie Dust (Offline) The Pixie Dust attack exploits weak nonce generation in WPS-implementing chipsets. The attack captures one full WPS handshake (M1-M4) and the
- Quick Workflow
- Detection
- Pixie Dust (Offline)
- Online PIN Brute-Force
- Lockout Handling
- Time Estimate
- Push-Button (PBC) Method
- PIN-Default Patterns
- Detection Considerations
- Engagement Cheatsheet
- Key References
wash — dedicated WPS scanner sudo wash -i wlan0mon Or use airodump-ng with WPS column sudo airodump-ng wlan0mon --wps reaver with Pixie Dust mode sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv bully alternative sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon reaver online mode (default) sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF \
What does the offensive-wps skill do?
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.
How do I install it?
Run `npx skills add SnailSploit/Claude-Red --skill offensive-wps --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SnailSploit/Claude-Red, a repository with 2,808 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.