bully

bully does the same job as reaver — brute-forcing a WPS PIN, with an optional Pixie-Dust mode via --pixiewps — but is a separate implementation of the WPS protocol, written to be more robust against APs that handle malformed or out-of-order WPS packets differently than reaver expects. wifite can use either engine (--bully vs. --reaver, reaver is the default); when reaver stalls or gets rate-limited on a particular AP, bully is usually the next thing worth trying.

It lives at Security → Wireless Attacks → bully. Needs root and a monitor-mode interface.

The help it prints

Show the full output48 lines
  bully v1.4
  the fork that actually works!
  maintained by kimocoder - https://twitter.com/kimocoder

  usage: bully <options> interface

  Required arguments:

      interface      : Wireless interface in monitor mode (root required)

      -b, --bssid macaddr    : MAC address of the target access point
   Or
      -e, --essid string     : Extended SSID for the access point

  Optional arguments:

      -c, --channel N[,N...] : Channel number of AP, or list to hop [b/g]
      -i, --index N          : Starting pin index (7 or 8 digits)  [Auto]
      -l, --lockwait N       : Seconds to wait if the AP locks WPS   [43]
      -o, --outfile file     : Output file for messages          [stdout]
      -p, --pin N            : Starting pin number (7 or 8 digits) [Auto]
      -s, --source macaddr   : Source (hardware) MAC address      [Probe]
      -v, --verbosity N      : Verbosity level 1-4, 1 is quietest     [3]
      -w, --workdir path     : Location of pin/session files  [~/.bully/]
      -5, --5ghz             : Hop on 5GHz a/n default channel list  [No]
      -B, --bruteforce       : Bruteforce the WPS pin checksum digit [No]
      -F, --force            : Force continue in spite of warnings   [No]
      -S, --sequential       : Sequential pins (do not randomize)    [No]
      -T, --test             : Test mode (do not inject any packets) [No]

  Advanced arguments:

      -d, --pixiewps         : Attempt to use pixiewps               [No]
      -r, --retries N        : Resend packets N times when not acked  [2]
      -1, --pin1delay M,N    : Delay M seconds every Nth nack at M5 [0,1]
      -2, --pin2delay M,N    : Delay M seconds every Nth nack at M7 [5,1]
      -A, --noacks           : Disable ACK check for sent packets    [No]
      -C, --nocheck          : Skip CRC/FCS validation (performance) [No]
      -D, --detectlock       : Detect WPS lockouts unreported by AP  [No]
      -E, --eapfail          : EAP Failure terminate every exchange  [No]
      -L, --lockignore       : Ignore WPS locks reported by the AP   [No]
      -M, --m57nack          : M5/M7 timeouts treated as WSC_NACK's  [No]
      -P, --probe            : Use probe request for nonbeaconing AP [No]
      -Q, --wpsinfo          : Use probe request to gather WPS info  [No]
      -W, --windows7         : Masquerade as a Windows 7 registrar   [No]
      -Z, --suppress         : Suppress packet throttling algorithm  [No]
      -V, --version          : Print version info and exit
      -h, --help             : Display this help information

Examples

# Standard WPS PIN brute-force, using bully instead of reaver
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -v 3

# Pixie-Dust attack via bully
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -d

# Point wifite at bully instead of reaver for the WPS phase
sudo wifite --wps-only --bully