Results 1 to 20 of 20

Thread: WPS Testing Errors

  1. #1
    Join Date
    2015-Sep
    Posts
    9

    WPS Testing Errors

    I have been trying to test pen my network since it has WPS for the past few days with no success. I also finally got an adapter that supports monitor mode and packet injection!

    I've been getting two errors

    • Failed to associate with blahblah
    • EAPOL START receive timeout


    Sometimes it associates sometimes it doesn't.. i've tried using aireplay as an article suggest to associate first but then that leads to the timeout error.
    My adapter is awus036nh and the command I input is:

    reaver -i mon0 -b [bssid] -vv
    I've also tried

    reaver -i mon0 -b -a -S -N -c -vv -w as someone suggest and received the same thing

    Any thoughts would be helpful!

  2. #2
    Join Date
    2015-Jul
    Location
    /home/duxim
    Posts
    408
    first what Kali you used?
    if you used 2.0 then you did everything wrong. to bring interface in monitor mode read this
    https://forums.kali.org/showthread.p...n-Kali-Linux-2

  3. #3
    Join Date
    2015-Oct
    Location
    texas
    Posts
    6
    try this

    airmon-ng start wlan0

    airmon-ng check kill

    wash -i wlan0mon

    pick target

    reaver -i wlan0mon -b bssid -c channel -vvv -K 1 -f

  4. #4
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    rev1500's advice is correct. However, I would add that, when you mostly get receive timeouts/fail to associate, it's likely that you are not close enough to the wifi router.

  5. #5
    Join Date
    2015-Sep
    Posts
    9
    Thanks for the replies! Hmm.. would you guys say would be the minimum reqs for a successful crack then?
    Also I have found bad packet with bad FCS when i try regular wash command.. does this correlate to anything?
    I have to add ignore fcs or -C to make it work
    Last edited by Auxh; 2015-10-28 at 00:49.

  6. #6
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    That's two questions in one reply...
    #2: "Bad fcs"? But this works?:
    wash -i wlan0mon --ignore-fcs
    I guess your particular hardware will have to be used that way.

    Back to #1: "What are minimum requirements for success"?
    Do you mean, how strong a signal must you receive? If you're in a rural area with few wifi signals, you might have acceptable reception over a surprisingly long distance. However, in city areas with dozens or even hundreds of wifi routers in range, you might not be able to connect to even a fairly strong signal.
    Trial and error, trial and error.
    Good luck!

  7. #7
    Join Date
    2015-Sep
    Posts
    9
    Quote Originally Posted by John_Doe View Post
    That's two questions in one reply...
    #2: "Bad fcs"? But this works?:
    wash -i wlan0mon --ignore-fcs
    I guess your particular hardware will have to be used that way.

    Back to #1: "What are minimum requirements for success"?
    Do you mean, how strong a signal must you receive? If you're in a rural area with few wifi signals, you might have acceptable reception over a surprisingly long distance. However, in city areas with dozens or even hundreds of wifi routers in range, you might not be able to connect to even a fairly strong signal.
    Trial and error, trial and error.
    Good luck!
    Ok .. this is starting to seem fishy. The network I attempted has a PWR/RSSI of -20 and yet it still sometimes gives me associate/eapol timeout errors. I live in a rural area with not too many wifi signal and i'd say the connection is fairly consistent. Any other diagnosis John Doe?

  8. #8
    Join Date
    2015-Sep
    Posts
    9
    Alright.. been fairly patient with this forum. 300+ views and hardly any useful advice. Anyone who can help me with this problem .. i'll be willing to pay. Only incentive that works around these parts. Paypal only.

  9. #9
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    I feel your pain, Auxh... I've made threads that went unsolved even after thousands of views.
    Your adapter should have the RTL8187L chipset, and that should work... however, your bad fcs results suggest you may have one of those fake Alfa's. (I myself have seen more than one fake Alfa! lol)
    My best advice: I suggest that instead of paypal'ing for advice, you spend just a few bucks getting an X-Media wifi adapter with a Ralink 3072 chipset: they're under twenty bucks delivered off Ebay. I predict it will make you very happy!

  10. #10
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    EDIT: oops, I guess the 036NH -should- have the RT3070 chipset, which is a fairly good chip, is that what you have? (I have in my hand a fake Alfa 036NH so that's why the discrepancy.)
    If you DO have the RT3070 chipset, and reaver isn't giving good results, I have to share a couple stories. Just now I'm playing with a Netgear WGR614v10 - it allows thirty wps tries, then goes "Detected AP rate limiting" for five minutes, then allows another thirty tries. But after four hours it stalls completely and allows no more attempts till after I reboot it.
    I've also seen wifi routers that just plain work lousy with reaver, lots of errors despite excellent signal strength.
    Recently I saw an issue with a Ubee Arris that was on the same frequency as another Arris, both with the same signal strength (but different SSIDs). When I changed one from channel 1 to channel 6, both responded to reaver perfectly.
    Just a few thoughts for you to chew on. Good luck with it!

  11. #11
    Join Date
    2015-Nov
    Posts
    3
    When you run the wash command is the router in the locked state? Have you had any pin attempts successfully tried?

  12. #12
    Join Date
    2013-Jul
    Location
    United States
    Posts
    520
    Hey, if you can get me a capture file of the network including:
    Code:
    +Beacon Frame
    +Probe Response
    I can take a look. The WPS protocol is very finicky (if that's the right word and spelling...) There are various things that cause it not to work and it has to be examined thoroughly to come to any conclusions.

  13. #13
    Join Date
    2013-Sep
    Posts
    264
    RT3070 is not recommended with reaver.(association is difficult + a lot of time out)
    You could try bully.

  14. #14
    Join Date
    2015-Nov
    Posts
    3
    Quote Originally Posted by soxrok2212 View Post
    Hey, if you can get me a capture file of the network including:
    Code:
    +Beacon Frame
    +Probe Response
    I can take a look. The WPS protocol is very finicky (if that's the right word and spelling...) There are various things that cause it not to work and it has to be examined thoroughly to come to any conclusions.
    How do you go about getting that information?

  15. #15
    Join Date
    2013-Jul
    Location
    United States
    Posts
    520
    Run airodump and have it save a capture and either just wait a bit until a client joins the network, or send a deauth so the client probes the network before joining. Just make sure it's in there before you post it.

  16. #16
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    Quote Originally Posted by soxrok2212 View Post
    Run airodump and have it save a capture and either just wait a bit until a client joins the network, or send a deauth so the client probes the network before joining. Just make sure it's in there before you post it.
    So basically, you're requesting that he capture a handshake and upload it. BE AWARE YOU WILL BE DISCLOSING YOUR APPROXIMATE REAL WORLD LOCATION if you do that. If that's OK, then go ahead, I'm really interested in soxrok's input.

  17. #17
    Join Date
    2013-Jul
    Location
    United States
    Posts
    520
    Quote Originally Posted by John_Doe View Post
    So basically, you're requesting that he capture a handshake and upload it. BE AWARE YOU WILL BE DISCLOSING YOUR APPROXIMATE REAL WORLD LOCATION if you do that. If that's OK, then go ahead, I'm really interested in soxrok's input.
    I have a good reputation on this forum, I'm not looking for information like that. Within the Beacon Frames and Probe Responses there is a lot of information regarding WPS (and more about configuration). I don't even need a handshake as long as you get a probe response and beacon. You can even filter out ever other packet if you wish.

    The following must be included by the WPS protocol.
    Code:
    Version
    Wi-Fi Protected Setup State
    AP Setup Locked
    Selected Registrar
    Device Password ID
    Selected Registrar
    Config Method
    Response Type
    UUID-E
    Manufacturer
    Model Name
    Model Number
    Serial Number
    Primary Device Type
    Device Name
    Config Methods
    RF Bands
    Other
    This is what I'm looking for and more often than not, if there is a problem it will be notified here.

  18. #18
    Join Date
    2013-Sep
    Posts
    264
    BE AWARE YOU WILL BE DISCLOSING YOUR APPROXIMATE REAL WORLD LOCATION
    It is not false but that's a bit exaggerated,
    By giving your probes+handshake to soxrok2212 he would know the name of your network (eSSID) and your bSSID (router' mac adress). So if he has a actualized WiFi map of the world he could know where you are. If you have any fear about soxrok2212 (maybe you should ) you can "spoof" your bSSID (change your mac adress) and change the name of your network to capture the handshake. Like this he won't be able to track your network name/mac address to get your "real world location".
    this is a therocial risk : it is very unlikely that your network would appear. You have people that practice what is called "wardriving", they go around with cars and check the wifi network. like wigle. Maybe the NSA have a good wifi map of the world... google was condemned in Germany and France because they made a wifi-map of this country while they went around with the street view cars. They had to give the disk where they strored this datas.
    Quote Originally Posted by soxrok2212
    I have a good reputation on this forum
    That's true : He is the drug dealer of many users of this forum and everybody will tell you that he always have first quality products. A very good reputation indeed.
    (@ DEA : That's a joke, don't break into his house for nothing )

  19. #19
    Join Date
    2015-Aug
    Location
    The Pits
    Posts
    86
    lol kcdtv!

    Dear soxrok, please don't think I am accusing you of anything, because actually I think VERY HIGHLY of you. I'm just pointing out that uploading a handshake identifies one's approximate vicinity. (because there IS such a thing as a partial worldwide map of wifi networks - ask Edward Snowden!)
    So, that being said, I'm very interested. What program should I open my .cap files with to see all that interesting information?

  20. #20
    Join Date
    2013-Jul
    Location
    United States
    Posts
    520
    Quote Originally Posted by John_Doe View Post
    lol kcdtv!

    Dear soxrok, please don't think I am accusing you of anything, because actually I think VERY HIGHLY of you. I'm just pointing out that uploading a handshake identifies one's approximate vicinity. (because there IS such a thing as a partial worldwide map of wifi networks - ask Edward Snowden!)
    So, that being said, I'm very interested. What program should I open my .cap files with to see all that interesting information?
    Wireshark will do the trick

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •