PIXIEWPS(1)

✨ PIXIEWPS(1) — Offline WPS bruteforce tool ✨

hiiii bestie 🫶 welcome to the manual page for pixiewps, chilling in section 1 of the manual (that's the 1 in PIXIEWPS(1) — section 1 is where all the user commands live, iykyk 💅). buckle up, we're doing the whole thing, no skimming, no skipping the "boring" bits. every single flag is coming with us. periodt. 🎀

---

🌸 NAME 🌸

pixiewps — Offline Wi-Fi Protected Setup bruteforce tool. that's her. that's the whole name. iconic. 👑

---

💫 DESCRIPTION 💫

Pixiewps is a tool written in C used to bruteforce offline the WPS PIN method exploiting the low or non-existing entropy of some Access Points, the so-called "pixie-dust attack". 🧚✨

It is meant for educational purposes only.

⚠️ bestie, say it back with me: educational purposes only. this is not a "go poke a network that isn't yours" situation and it never was. that's the disclaimer and it's not optional, no cap. 🙈

---

🦋 SYNOPSIS 🦋

pixiewps <arguments>

---

👑 ARGUMENTS 👑

💖 REQUIRED ARGUMENTS 💖

• -e, --pke — Enrollee's DH public key, found in M1. it's literally sitting right there in M1, go get it. 🍓
• -r, --pkr — Registrar's DH public key, found in M2. you can dodge this one by specifying --dh-small in both Reaver and pixiewps. like so:

pixiewps -e <pke> -s <e-hash1> -z <e-hash2> -a <authkey> -n <e-nonce> -S

• -s, --e-hash1 — Enrollee's hash 1, found in M3. It's the hash of the first half of the PIN. 🎯
• -z, --e-hash2 — Enrollee's hash 2, found in M3. It's the hash of the second half of the PIN. 🎯
• -a, --authkey — Authentication session key. okay so, for this parameter you need a modified version of Reaver or Bully — but you can avoid it entirely by specifying small Diffie-Hellman keys in both Reaver and pixiewps and supplying --e-nonce, --r-nonce and --e-bssid. look:

pixiewps -e <pke> -s <e-hash1> -z <e-hash2> -S -n <e-nonce> -m <r-nonce> -b <e-bssid>

• -n, --e-nonce — Enrollee's nonce, found in M1. 🌈

🌟 OPTIONAL ARGUMENTS 🌟

• -m, --r-nonce — Registrar's nonce, found in M2. Used with other parameters to compute the session keys. 🔑
• -b, --e-bssid — Enrollee's BSSID. Used with other parameters to compute the session keys. 🔑
• -S, --dh-small (deprecated) — Small Diffie-Hellman keys. The same option must be specified in Reaver too. Some Access Points seem to be buggy and don't behave correctly with this option. Avoid using it with Reaver when possible.

💀 heads up: this one is deprecated and it's giving buggy-AP energy. some Access Points just do not vibe with it. skip it with Reaver whenever you can, fr fr.

• -v, --verbosity — Verbosity level 1-3, 1 is quietest, default is 3. (yes, 3 is the default, so she's chatty by default. main character energy. 💅)
• -h — Display a simple help usage screen.
• --help — Display verbose help.
• -V, --version — Display version and other information. 🏷️
• --mode N[,... N] — Select modes, comma separated (experimental modes are not used unless specified):
  • 1 - RT/MT/CL
  • 2 - eCos simple
  • 3 - RTL819x
  • 4 - eCos simplest [Experimental]
  • 5 - eCos Knuth [Experimental]
• --start [mm/]yyyy, --end [mm/]yyyy — Starting and ending dates for mode 3, they are interchangeable.

If only one is specified, the current time will be used for the other. The earliest possible date is 01/1970, corresponding to 0 (Unix epoch time), the latest is 02/2038, corresponding to 0x7FFFFFFF. If --force is used then pixiewps will start from the current time and go back all the way to 0.

🕰️ --force is the "okay we're going ALL the way back" button. it walks backwards from right now down to 0. that's a whole lotta walking, bestie.

🎀 MISCELLANEOUS ARGUMENTS 🎀

• -7, --m7-enc — Encrypted settings, found in M7. Recover Enrollee's WPA-PSK and secret nonce 2. This feature only works on some Access Points vulnerable to mode 3.

pixiewps -e <pke> -r <pkr> -n <e-nonce> -m <r-nonce> -b <e-bssid> -7 <enc7> --mode 3

• -5, --m5-enc — Encrypted settings, found in M5. Recover Enrollee's secret nonce 1. This option must be used in conjunction with --m7-enc. If --e-hash1 and --e-hash2 are also specified, pixiewps will also recover the WPS PIN. 👀

pixiewps -e <pke> -r <pkr> -n <e-nonce> -m <r-nonce> -b <e-bssid> -7 <enc7> -5 <enc5> --mode 3

pixiewps -e <pke> -r <pkr> -n <e-nonce> -m <r-nonce> -b <e-bssid> -7 <enc7> -5 <enc5> --mode 3 -s <e-hash1> -z <e-hash2>

---

🔥 EXAMPLES 🔥

long-form era, everything spelled out:

pixiewps --pke <pke> --pkr <pkr> --e-hash1 <e-hash1> --e-hash2 <e-hash2> --authkey <authkey> --e-nonce <e-nonce>

and the short-flag version, for when you're typing fast:

pixiewps -e <pke> -r <pkr> -s <e-hash1> -z <e-hash2> -a <authkey> -n <e-nonce>

---

💜 AUTHOR 💜

Pixiewps was developed by wiire.

This manual page was written by Daniel Echeverry <epsilon77@gmail.com> and Samuel Henrique <samueloph@gmail.com> for the Debian project, but can be used by other projects as well.

---

that's the whole page, bestie, you made it to the end 🫶 this was pixiewps, dated November 2017, from the pixiewps source, and honestly? she ate. 💅✨ go forth and read your flags carefully. 🦋