reaver
Recover WPA/WPA2 passphrases by brute-forcing the WPS PIN on targets with WPS enabled, exploiting the vulnerability to obtain the PSK without capturing a handshake.
Instructions
WPS (WiFi Protected Setup) brute-force attack tool. Exploits the WPS PIN vulnerability to recover the WPA/WPA2 passphrase without needing a captured handshake. Use when the target AP has WPS enabled (many do by default). For full WiFi attack automation including WPA handshake capture, use wifite. Output: WPA PSK (password) and AP details on success, or PIN attempt progress.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| opts | No | Additional reaver options (e.g. '-vv' for very verbose, '-t 10' for timeout) | |
| bssid | Yes | Target AP BSSID — MAC address of the access point (e.g. 'AA:BB:CC:DD:EE:FF') | |
| channel | No | Channel number the target AP is on (e.g. '6', '11') | |
| interface | Yes | Wireless interface in monitor mode (e.g. wlan0mon) |