Well I guess it's a hit or miss type of attack, and I don't even know if it's an attack but it's a theoretical attack. In these circumstances, the victim uses WPA or WPA2 and WPS is enabled... or is supported by the router. The attacker continuously deauths the AP when there are clients and HOPEFULLY the client's or owned doesn't know what's wrong and tries multiple solutions... such as power cycles and maybe eventually a reset. After the router is reset to default settings, the network is unencrypted. The attacker then logs onto the router and grabs the WPS pin which he/she can then pop into reaver. Once (if) the encryption is turned back on on the router, the attacker can punch in the pin into reaver and snag the WPA or WPA2 password (assuming WPS isn't turned off immediately). This idea is all based on luck I guess you could say. Can anyone put in their 2 cents on how they feel or other ways to perform this? Or even other methods?
