Start Reaver : estimated time: Between 2 and 10 hours Material that may be Useful: Guide: “Hacking my own router with Reaver, guide to brute forcing Wifi Protected Setup” (Nathan Heafner) Guide: “WPS – How to install and use Reaver to detect the WPS on your home router” (University of South Wales) Documentation: “Airodump-ng” (Aircrack-ng Wiki) Tutorial: “Resetting WPS Lockouts” (Kali Linux Forums) Recommendation WPS Pin entry should be disabled on the wireless router, or only enabled temporarily to add new devices to the network. WEP PASSWORD CRACKING Summary WEP provides no effective protection for a wifi network. Most wifi routers offer WPA encryption as an option, and if this is available it should be immediately implemented. Some older routers (and wifi devices) do not support WPA. It is highly recommended to upgrade immediately to hardware that supports WPA and to eliminate all WEP network access. Walkthrough The auditor can be guaranteed to access a WEP network with sufficient time by cracking the WEP key. Start the wireless interface in monitor mode on the specific AP channel Use aireplay-ng to do a fake authentication with the access point Start airodump-ng on AP channel with a bssid filter to collect the new unique IVs Start aireplay-ng in ARP request replay mode to inject packets Run aircrack-ng to crack key using the IVs collected Material that may be Useful: Page 51 of 240