As we conclude the WPA3 module, it's vital to address the removal of the industry's most notorious backdoor: Wi-Fi Protected Setup (WPS). Designed for convenience, WPS became the primary vector for compromising home networks for years.
WPS allows a user to connect by entering an 8-digit PIN. However, the AP validates the PIN in two halves (4 digits then 4 digits), and it tells the client *which half* is wrong. This reduces the entropy from 100 million possibilities to just 11,000.
A WPA2 password could be 63 characters long, but if WPS is enabled, the attacker only needs to crack the 8-digit PIN to get that password.
The terminal output shows a classic Reaver attack. Once the PIN is cracked, the AP automatically hands over the actual WPA2/WPA3 password in plaintext.
💡 WPA3 replaces the insecure WPS PIN with 'Wi-Fi Device Provisioning Protocol' (DPP), also known as 'Easy Connect'.
# DPP Process (Conceptual)
# 1. User scans a QR code on the new device
# 2. Phone uses the QR data to start an encrypted session
# 3. Device is provisioned with the network credentials securely| Feature | Legacy WPS | WPA3 DPP (Easy Connect) |
|---|---|---|
| Auth Method | 8-digit PIN | QR Code / NFC |
| Vulnerability | Brute-forceable PIN | None (Public Key based) |
| User Experience | Button press/PIN entry | Scan QR Code |
| Attack Vector | Reaver / Pixie Dust | Physical access to QR |
Regardless of whether you use WPA2 or WPA3, the first step in any wireless security audit is to ensure that legacy WPS is completely disabled.
Some routers 'hide' WPS but keep the service running. Always verify with a packet sniffer (Wash) that the WPS elements are gone from the beacon.
Verify exercises to earn ★ 150 XP and unlock next lab level.