

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP)

Another question is about Reaver-WPS, what if an access point doesn't support WPS, or is disabled? Will Reaver work on such AP

share|improve this question
I don't have sources so I won't write an Answer, but no - you can go past WPA without brute-forcing it. It just that the math is complicated enough that running through the most common passwords first is probably faster for the intruder in many cases. – medivh Jul 30 '13 at 7:03
If WPS is disabled then the exploit against WPS won't work. If you have questions about WPA I suggest you do some research on the algorithm. – Ramhound Jul 30 '13 at 11:42
Yes, WPA can be cracked without brute force.… – user69354 Mar 1 '15 at 0:45
up vote 6 down vote accepted

WPA can be used with different protocols. Using WPA-TKIP, there are alternative attacks than the common handshake-bruteforce, but those will not grant you access to the AP. These attacks focus on RC4 weaknesses (similar to WEP, but far less effective due to successful countermeasures).

I assume that you want to acces an AP. In this case, bruteforcing is the only possible way to crack WPA. You capture a handshake between client and accesspoint, and perform the challenge-response yourself with different passwords, until your result matches the one you captured.

This can be sped up by using rainbow-tables, although you will have to find a target using a popular SSID in order to have an existing rainbow table.

Thus, to protect against intruders, you should choose an uncommon SSID along with a fairly long and complex password.

And no, you can not attack WPS when WPS is disabled or not supported. There may be bugs preventing a user from disabling WPS, but i consider these APs WPS-enabled.

share|improve this answer
You might want to add a reference the "shoulder-surfing" (and similar) class of attacks to your answer: that usually the easiest way to grab a WAP/WEP password. – Stephane Oct 30 '13 at 10:37
@Stephane a legitimate user will not type password everytime, however social engineering attacks always works – Mark Evans Oct 31 '13 at 3:48
@MarkEvans That pretty much what I meant: brute-forcing the WAP key is usually not the easiest way in. – Stephane Oct 31 '13 at 8:21

Your Answer


