{"action":"created","issue":{"url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/50","repository_url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x","labels_url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/50/comments","events_url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/50/events","html_url":"https://github.com/t6x/reaver-wps-fork-t6x/issues/50","id":132499891,"number":50,"title":"brute force broken by inversion of p1 and p2 indexes  while using option -p ","user":{"login":"kcdtv","id":7338484,"avatar_url":"https://avatars.githubusercontent.com/u/7338484?v=3","gravatar_id":"","url":"https://api.github.com/users/kcdtv","html_url":"https://github.com/kcdtv","followers_url":"https://api.github.com/users/kcdtv/followers","following_url":"https://api.github.com/users/kcdtv/following{/other_user}","gists_url":"https://api.github.com/users/kcdtv/gists{/gist_id}","starred_url":"https://api.github.com/users/kcdtv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcdtv/subscriptions","organizations_url":"https://api.github.com/users/kcdtv/orgs","repos_url":"https://api.github.com/users/kcdtv/repos","events_url":"https://api.github.com/users/kcdtv/events{/privacy}","received_events_url":"https://api.github.com/users/kcdtv/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-02-09T18:51:50Z","updated_at":"2016-08-14T20:57:43Z","closed_at":null,"body":"I did not realized this until some day agos\r\nbasic command line **without** -p option :+1: \r\n`sudo reaver -ilan0mon -vv -b 9C:97:26:A1:27:C7 \r\n\r\nReaver v1.5.2 WiFi Protected Setup Attack Tool\r\nCopyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>\r\nmod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212 & Wiire & kib0rg\r\n\r\n[+] Waiting for beacon from 9C:97:26:A1:27:C7\r\n[+] Switching wlan0mon to channel 1\r\n[+] Switching wlan0mon to channel 2\r\n[+] Switching wlan0mon to channel 3\r\n[+] Switching wlan0mon to channel 4\r\n[+] Switching wlan0mon to channel 5\r\n[+] Switching wlan0mon to channel 6\r\n[+] Associated with 9C:97:26:A1:27:C7 (ESSID: Jazztel_A127C7)\r\n[+] Starting Cracking Session. Pin count: 0, Max pin attempts: 11000\r\n[+] Trying pin 12345670.\r\n[+] Sending EAPOL START request\r\n[+] Received identity request\r\n[+] Sending identity response\r\n[+] Received M1 message\r\n[+] Sending M2 message\r\n[+] Received M3 message\r\n[+] Sending M4 message\r\n[+] Received WSC NACK\r\n[+] Sending WSC NACK\r\n[+] p1_index set to 1\r\n[+] Pin count advanced: 1. Max pin attempts: 11000\r\n[+] Trying pin 00005678.\r\n[+] Sending EAPOL START request\r\n[+] Received identity request\r\n[+] Sending identity response\r\n[+] Received M1 message\r\n[+] Sending M2 message\r\n[+] Received M3 message\r\n[+] Sending M4 message\r\n[+] Received WSC NACK\r\n[+] Sending WSC NACK\r\n[+] p1_index set to 2\r\n[+] Pin count advanced: 2. Max pin attempts: 11000\r\n`\r\neverything goes well, i try 12345670 and another PIN, p1_index is set to 2 as it should\r\n\r\nsame command line just adding the option -p , same PA,\r\n`sudo reaver -i wlan0mon -vv -b 9C:97:26:A1:27:C7 -p 12345670\r\n\r\nReaver v1.5.2 WiFi Protected Setup Attack Tool\r\nCopyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>\r\nmod by t6_x <t6_x@hotmail.com> & DataHead & Soxrok2212 & Wiire & kib0rg\r\n\r\n[+] Waiting for beacon from 9C:97:26:A1:27:C7\r\n[+] Switching wlan0mon to channel 1\r\n[+] Switching wlan0mon to channel 2\r\n[+] Switching wlan0mon to channel 3\r\n[+] Switching wlan0mon to channel 4\r\n[+] Switching wlan0mon to channel 5\r\n[+] Switching wlan0mon to channel 6\r\n[+] Associated with 9C:97:26:A1:27:C7 (ESSID: Jazztel_A127C7)\r\n[+] Starting Cracking Session. Pin count: 10000, Max pin attempts: 11000\r\n[+] Trying pin 12345670.\r\n[+] Sending EAPOL START request\r\n[+] Received identity request\r\n[+] Sending identity response\r\n[+] Received M1 message\r\n[+] Sending M2 message\r\n[+] Received M3 message\r\n[+] Sending M4 message\r\n[+] Received WSC NACK\r\n[+] Sending WSC NACK\r\n[+] p2_index set to 1\r\n[+] Pin count advanced: 10001. Max pin attempts: 11000\r\n[+] Trying pin 12345670.\r\n[+] Sending EAPOL START request\r\n[+] Received identity request\r\n[+] Sending identity response\r\n[+] Received M1 message\r\n[+] Sending M2 message\r\n[+] Received M3 message\r\n[+] Sending M4 message\r\n[+] Received WSC NACK\r\n[+] Sending WSC NACK\r\n[+] p2_index set to 2\r\n[+] Pin count advanced: 10002. Max pin attempts: 11000\r\n[!] WARNING: Detected AP rate limiting, waiting 60 seconds before re-checking\r\n^C\r\n[+] Session saved.\r\n`\r\neven if i am having a fluent wps flow, i just try the PIN 12345670\r\nThis is because  p1_index does not rise while first half PIN are checked\r\na typo or something made growth on p2_index and the counting on *.wpc file are corrupted\r\nBrute force is not possible while using the -p option\r\n\r\npost scriptum : i used the very last version to test the bug "},"comment":{"url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/comments/239696281","html_url":"https://github.com/t6x/reaver-wps-fork-t6x/issues/50#issuecomment-239696281","issue_url":"https://api.github.com/repos/t6x/reaver-wps-fork-t6x/issues/50","id":239696281,"user":{"login":"kcdtv","id":7338484,"avatar_url":"https://avatars.githubusercontent.com/u/7338484?v=3","gravatar_id":"","url":"https://api.github.com/users/kcdtv","html_url":"https://github.com/kcdtv","followers_url":"https://api.github.com/users/kcdtv/followers","following_url":"https://api.github.com/users/kcdtv/following{/other_user}","gists_url":"https://api.github.com/users/kcdtv/gists{/gist_id}","starred_url":"https://api.github.com/users/kcdtv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcdtv/subscriptions","organizations_url":"https://api.github.com/users/kcdtv/orgs","repos_url":"https://api.github.com/users/kcdtv/repos","events_url":"https://api.github.com/users/kcdtv/events{/privacy}","received_events_url":"https://api.github.com/users/kcdtv/received_events","type":"User","site_admin":false},"created_at":"2016-08-14T20:57:43Z","updated_at":"2016-08-14T20:57:43Z","body":"  I update this issue after testing reaver 1.3 and reaver 1.4\r\nAs KoboSoft said the original work of Craig HEFFNER was implemented this way:\r\nReaver tries continuously the same PIN (the one that we indicate) \r\n  Nevertheless the actual situation is not OK.\r\n  We have 2 options: \r\n                                  1) We leave the option -p as it is\r\n                                  2) We change it \r\n1) If we leave the option -p as it is we definitely have to do something about this continuous loop with a non legitimate  PIN:  It can wake u the AP rate limit \r\nA way to do it is to automatically associate the use of the option -p with the argument **-g 1** (one PIN tried) \r\n   The help should be modified to advert that the PIN entered will be the only one tested  \r\n 2) I would rather change the \"concept\" of the option and solve this precise issue (reaver rise p2 index instead of p1) \r\n  If we just want to try one PIN that we introduce and stop after  we just have to use the argument **g -1**   \r\n  If we want to try a PIN first and continue brute force we just use the option -p with the PIN we want.\r\n  This approach is more flexible and gives more freedom to the user"}}
{"actor":{"display_login":"kcdtv"}}