Possible to start reaver with a specific number?

[soxrok2212]

I've noticed A LOT of NETGEAR router's WPS pins start with 2xxxxxxx. I know reaver does the bruteforce by working backwards on both ends... ex 12349876 12359875 or something like that. But is there a way to start it with a specific number to begin the attack? (Look on ebay for netgear routers...many pictures show the WPS pin and a good amount starts with 2.) Thanks!

[rastamouse]

Reaver has a -p option where you can specify the WPS to use. I don't know if you can use wildcards like -p 3* to make it try pins starting with a specific number. I haven't got any kit immediately available to test.

[fl3xu5]

Just use the -p option in the reaver command to Use the specified WPS pin to recover the WPA/WPA2 passphrase.

For example : reaver -i mon0 -b 00:90:4C:C1:AC:21 -p 2xxxxx -vv

[soxrok2212]

I've actually found a way that somewhat works... Navigate to your reaver file (mine was /etc/reaver) then select the bssid.wpc. Then edit the first 4 numbers to be between 0 and 9999. Changing it to 1000 is about even to starting with pin 1000xxxx 2000 is about even to 2000xxxx and so on. Make sure you save and then start reaver.