wps pin vendor specific

[s0i37]

Hello.
What about vendor specific WPS pin?

[kimocoder]

What?

[claude]

Claude finished @kimocoder's task in 56s —— View job

---

Analysis of Issue #476: WPS Pin Vendor Specific

• Read relevant WPS code in the codebase
• Understand what "vendor specific WPS pin" means
• Provide explanation and analysis

---

The issue author (@s0i37) is asking about vendor-specific WPS PIN generation — a technique where certain router manufacturers use predictable WPS PIN algorithms based on the device's MAC address (BSSID) or serial number.

What is "vendor-specific WPS PIN"?

Some routers from specific manufacturers (Belkin, D-Link, Mediatek/Ralink, ZTE, Zyxel, etc.) generate their default WPS PIN deterministically from their MAC address. Tools like wpspin (by Drygdryg) can compute these likely PINs instantly, making it much faster than a full brute-force.

Instead of trying all ~11,000 possible WPS PINs, you try just ~10–20 vendor-specific computed PINs first.

Current state of wifite2

Wifite2 currently supports three WPS attack modes (via reaver/bully):

1. Pixie-Dust — exploits weak random number generators
2. NULL PIN — tries an empty PIN
3. PIN brute-force — full sequential enumeration (slow, ~hours)

Vendor-specific PIN generation is not currently implemented. There is no hook to try computed MAC-based pins before falling back to full brute-force.

What the feature request would entail

Adding support would require:

1. Detecting the router manufacturer from the BSSID OUI (first 3 bytes of MAC)
2. Computing vendor-specific candidate PINs using the known algorithms
3. Trying those PINs first via reaver -p <pin> before full brute-force

This is a legitimate enhancement. External tools like wpspin (Python) or the algorithms documented in public WPS research can compute these pins. The reaver command already supports -p <pin> to try a specific PIN.

[s0i37]

I implemented all 4 methods in https://github.com/s0i37/wifi/blob/main/wps_brute-width.sh (fast pixie/vendor/null) and https://github.com/s0i37/wifi/blob/main/wps_brute.sh (slow full enum).
Vendor specific was implemented with wpspin (https://github.com/drygdryg/wpspin) but author removed this tool. Also the following repo have mac-pin database:

https://github.com/fulvius31/Default-WPS-PINs
https://github.com/linkp2p/WPS-PIN