[Rafe_D]

HF Default Font (Click to View)

Ok so using this Method you can have Reaver run pins 3 ways.

• Backwards
  


• Any order you choose
  


• Start AND CONTINUE from a pin you choose

Things you'll need:

• To keep this simple I'm just using a live USB with BackTrack 5R3. If you have any form of persistence set then there are a couple of step's you can skip.
  
  


• The Ability to use Reaver.
  
  


• The Ability to save and recover the file even after a reboot.

For simplicity this Method is designed to test against your own AP and written with noobs in mind.

Getting Started

The first thing we need to do is create a file.
Reaver will do this for us.
Run your normal reaver command against a WPS enabled AP.
When Reaver try's the Second pin press CTRL + C.
Reaver will save the session.
Take note of the BSSID of the AP.

Open a New Terminal.

In this next command where I have written ENTER BSSID HERE.wpc you will need to change it to the BSSID of the AP you used without entering the colon's.

EG: If your BSSID was 11:22:33:44:55:66 then the command will be gedit '/usr/local/etc/reaver/112233445566.wpc'

What you should now be seeing is the file reaver use's to run the pin's.

The first line tell's reaver what pin it is up to. Change it back to 0 so reaver will start from the begining.

Now Back up the file so you can use it in the future.

If you want reaver to start and continue from a certain pin, let's use 0130, scroll down to that pin and check the bottom right corner for the Ln X, Col X and then -4.

EG: If you scroll down to 0130 it's on Ln 144.
144 - 4 is 140.
If we change the first line to 140 then reaver will run the session from pin 0130 upwards.

The second line tells reaver were to start the second half of the Pin minus the checksum. So you only need the first three digit's.
Scroll down to your desired Pin. I'll use 011. It's on Ln 10024. Now - 10004.

EG: If you scroll down to 011 it's on Ln 10024.
10024 - 10004 = 20.
If we change the second line to 20 then reaver will now start our session with the Pin 0130011.

To Run Reaver Backwards.

The 4th line tell's reaver the order of the pin's to try. These are what we will be altering.

Go back to the Terminal and press CTRL + C

Now enter the command cd /pentest/passwords/crunch/

Now enter the command ./crunch 4 4 9876543210 -d 3% -o Rafe_D

Now enter the command gedit '/pentest/passwords/crunch/Rafe_D'

Now you need to scroll down the file and locate and delete the numbers 0123 and 1234.
Make sure not to leave any blank lines between the numbers before or after.
Any extra lines and the file wont run properly.
Not enough lines and the file wont run properly.
It should look the same as when you opened it
Once you have done this press CTRL + A to highlight all then CTRL + C to Copy it to the clipboard.

Now go to your Original BSSID.wpc file and check that the first line is 0. Then scroll down to Ln 16 or 0001 and highlight to Ln 10003 or 9998 and delete them all.
Now press CTRL + V and paste the crunch file in it's place.
The number's should now go from 9998 down to 0001.
Check this file from top to bottom making sure there are no blank lines.
Click on the save button.

Now backup this file somewhere you can find and use it in the future.

Using the file.

Whenever you want to use this file it need's to be in the reaver directory.
The same location that we found the original file.
You can navigate there with File System/usr/local/etc/reaver then Copy and Paste or Drag and Drop the file.
Unless you want to use the -s command it must be named with the BSSID (without the colon's) of the AP your testing.

EG: 112233445566.wpc

Run airodump-ng and then rename the file to the BSSID of the AP you want to test.
Run reaver as per normal.
EG: reaver -i mon0 -b 11:22:33:44:55:66 -S -vv
Reaver should now ask Restore previous session for BSSID HERE (Mine was 11:22:33:44:55:66) [n/Y]?
Type y then press enter.

Reaver should start with 12345670.
This is the most common default pin.
That's why we haven't changed the first few.
It will then start running the pins backwards.

Trouble Shooting

If reaver start's with 1234XXXX and not 12345670 then you either have to many or not enough lines in the file you made.
If reaver start's with anything but 1234 then you have forgotten to change the first line of the file to a 0.

As a bit of research I would be interested to know if running the pins backwards would have been quicker for anybody. IE: WPS pins above 5000 0000



Ok so using this Method you can have Reaver run pins 3 ways.

• Backwards
  


• Any order you choose
  


• Start AND CONTINUE from a pin you choose

Things you'll need:

• To keep this simple I'm just using a live USB with BackTrack 5R3. If you have any form of persistence set then there are a couple of step's you can skip.
  
  


• The Ability to use Reaver.
  
  


• The Ability to save and recover the file even after a reboot.

For simplicity this Method is designed to test against your own AP and written with noobs in mind.

Getting Started


The first thing we need to do is create a file.
Reaver will do this for us.
Run your normal reaver command against a WPS enabled AP.
When Reaver try's the Second pin press CTRL + C.
Reaver will save the session.
Take note of the BSSID of the AP.

Open a New Terminal.

In this next command where I have written ENTER BSSID HERE.wpc you will need to change it to the BSSID of the AP you used without entering the colon's.

EG: If your BSSID was 11:22:33:44:55:66 then the command will be gedit '/usr/local/etc/reaver/112233445566.wpc'

What you should now be seeing is the file reaver use's to run the pin's.

The first line tell's reaver what pin it is up to. Change it back to 0 so reaver will start from the begining.

Now Back up the file so you can use it in the future.

If you want reaver to start and continue from a certain pin, let's use 0130, scroll down to that pin and check the bottom right corner for the Ln X, Col X and then -4.

EG: If you scroll down to 0130 it's on Ln 144.
144 - 4 is 140.
If we change the first line to 140 then reaver will run the session from pin 0130 upwards.

The second line tells reaver were to start the second half of the Pin minus the checksum. So you only need the first three digit's.
Scroll down to your desired Pin. I'll use 011. It's on Ln 10024. Now - 10004.

EG: If you scroll down to 011 it's on Ln 10024.
10024 - 10004 = 20.
If we change the second line to 20 then reaver will now start our session with the Pin 0130011.

To Run Reaver Backwards.

The 4th line tell's reaver the order of the pin's to try. These are what we will be altering.

Go back to the Terminal and press CTRL + C

Now enter the command cd /pentest/passwords/crunch/

Now enter the command ./crunch 4 4 9876543210 -d 3% -o Rafe_D

Now enter the command gedit '/pentest/passwords/crunch/Rafe_D'

Now you need to scroll down the file and locate and delete the numbers 0123 and 1234.
Make sure not to leave any blank lines between the numbers before or after.
Any extra lines and the file wont run properly.
Not enough lines and the file wont run properly.
It should look the same as when you opened it
Once you have done this press CTRL + A to highlight all then CTRL + C to Copy it to the clipboard.

Now go to your Original BSSID.wpc file and check that the first line is 0. Then scroll down to Ln 16 or 0001 and highlight to Ln 10003 or 9998 and delete them all.
Now press CTRL + V and paste the crunch file in it's place.
The number's should now go from 9998 down to 0001.
Check this file from top to bottom making sure there are no blank lines.
Click on the save button.

Now backup this file somewhere you can find and use it in the future.

Using the file.

Whenever you want to use this file it need's to be in the reaver directory.
The same location that we found the original file.
You can navigate there with File System/usr/local/etc/reaver then Copy and Paste or Drag and Drop the file.
Unless you want to use the -s command it must be named with the BSSID (without the colon's) of the AP your testing.

EG: 112233445566.wpc

Run airodump-ng and then rename the file to the BSSID of the AP you want to test.
Run reaver as per normal.
EG: reaver -i mon0 -b 11:22:33:44:55:66 -S -vv
Reaver should now ask Restore previous session for BSSID HERE (Mine was 11:22:33:44:55:66) [n/Y]?
Type y then press enter.

Reaver should start with 12345670.
This is the most common default pin.
That's why we haven't changed the first few.
It will then start running the pins backwards.

Trouble Shooting

If reaver start's with 1234XXXX and not 12345670 then you either have to many or not enough lines in the file you made.
If reaver start's with anything but 1234 then you have forgotten to change the first line of the file to a 0.

As a bit of research I would be interested to know if running the pins backwards would have been quicker for anybody. IE: WPS pins above 5000 0000

[HackRain]

Great tutorial.

If you don't mind, i will be adding it to my index sickie thread , upon its next update.

[Baumers]

Whay i can not see digits???

[IMG]http://img197.imageshack.us/img197/4784/45830274.jpg[/IMG]

Uploaded with ImageShack.us

[HackRain]

Whay i can not see digits???

Because you just opened the wrong file.
you need to change the "Rafe_d" in the file path, too whatever your user name may be.

[Rafe_D]

Great tutorial.

If you don't mind, i will be adding it to my index sickie thread , upon its next update.

Thanks Mate.
I don't mind at all. Do with it as you please.

Whay i can not see digits???

Screenshot (Click to View)[IMG]http://img197.imageshack.us/img197/4784/45830274.jpg[/IMG]

It would be easier to help you if you had of shown the screenshot of the terminal instead.
The 2 logical reason's are:

• You entered a wrong command.
  


• You changed the name of the file.

Let's deal with both of them and then if all else fails for you, you can try the GUI.

Firstly I'll explain the commands used and then the relationship between them should be self explanitory.

./crunch 4 4 9876543210 -d 3% -o Rafe_D

./crunch: Run crunch
4 4: Minimum length and Maximum length.
9876543210: These are the character's we want crunch to use, but more importantly, this is the order we want crunch to use them.
-d 3%:

• -d Limits the number of consecutive identical characters.


• 3 thus limiting them to 3 consecutive character's and automatically removing 9999, 8888 --> 1111, 0000 instead of manually deleting them ourselves as they are already in the start of the reaver file.


• % as this is a shortcut that crunch recognises as numeric character's.

-o: Allows you to specify the file name / location for the output, e.g. /media/flashdrive/wordlist.txt

I intentionally left the File Path out of -o so that anyone can find the file, through numerous method's, in the crunch directory. It's named Rafe_D and the file path is as listed in the command.

gedit '/pentest/passwords/crunch/Rafe_D'

This does one of 2 things. Basically it tells gedit to either:

• Open the file in the file path.
  


• Create, Name and Open a file in the Directory of the File Path.
  

You should now be armed with more than enough knowledge to create, find, understand and use the file.

Sorry if my answer seem's a bit harsh but part of the idea for the TuT was for people to learn something. It would be only to easy for me to have uploaded the .wpc file, told you were to put it, how to rename it and use it, but nobody would have learn't anything.

If you still can't get it working, in the next couple of days, let me know and I will work through it with you.

[HackRain]

Added to Stickie thread, and titled: "reaver manipulation: customizing pin attempt's."
23, December, 2012

[teonanacalt]

Thanks for this sharing,sir/madame! good tutorial,very useful.
Appreciate.

[Paruffka]

Backtrack ♥ I will try it now, looks good.

[21redallday12]

Good idea!
I Never thought about that one!

[DBlue]

Rafe_D, remembered reading this thread a week or so ago and today I'm running Reaver for over 5 hours on a Netgear AP. My laptop crashes and because it's running Backtrack from a USB everything is lost. But because of you and your thread I'm able to pick up approximately where the computer spit the "byte". Many, many thanks, you deserve a promotion.

[Rafe_D]

Added to Stickie thread, and titled: "reaver manipulation: customizing pin attempt's."
23, December, 2012

Thanks Mate.

Thanks for this sharing,sir/madame! good tutorial,very useful.
Appreciate.

Thanks for your feedback and Your welcome.

Rafe_D, remembered reading this thread a week or so ago and today I'm running Reaver for over 5 hours on a Netgear AP. My laptop crashes and because it's running Backtrack from a USB everything is lost. But because of you and your thread I'm able to pick up approximately where the computer spit the "byte". Many, many thanks, you deserve a promotion.

I'm glad it helped someone. My whole need to manipulate the pins came about after loosing 70 straight hours several times. Some AP's only allow 1 pin/60 secs. I now right down the last pin I see, and time, before leaving the PC for any length of time. At least then I have a reference point and could possibly calculate the pin reaver was up to if I can determine the time it stopped tryinging. EG: Blackout's.

[Cork]

Thanks dude i really appreciate the effort you put into this

[CPDalpha]

Hi,

I've tried to open the reaver list I let it run a fair few pin numbers, I open the list but it's completely blank still. Retried again same thing,

Any ideas?

I lost my reaver session i've been running for ages because windows 8 FORCED a restart I literally couldn't stop... so pissed right now.

Edit: Ahh solved it, instead went through file browser manually rather than use the command. Back on track thanks for the guide :D

[Bert420000]

didnt even think of that i had to backtrack myself

[rootipconfig]

this is a great tutorial! thank you so much. I think its great you decided to run it backwards, makes the most sense when in many cases it doesn't crack till the end. you da man!