2.2.5: PMKID timeout changed to 30sec. --pmkid-timeout option to change.

For #134

README.md

@@ -5,32 +5,30 @@ This repo is a complete re-write of [`wifite`](https://github.com/derv82/wifite)
 
 Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches!
 
-Wifite is compatible with both `python2` and `python3`.
-
 Wifite is designed to use all known methods for retrieving the password of a wireless access point (router).  These methods include:
-1. WPS: The [WPS Pixie-Dust attack](https://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dangerous/)
-2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
-3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) and offline crack.
+1. WPS: The [Offline Pixie-Dust attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)
+1. WPS: The [Online Brute-Force PIN attack](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Online_brute-force_attack)
+2. WPA: The [WPA Handshake Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
+3. WPA: The [PMKID Hash Capture](https://hashcat.net/forum/thread-7717.html) + offline crack.
 4. WEP: Various known attacks against WEP, including *fragmentation*, *chop-chop*, *aireplay*, etc.
 
 Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.
 
 Supported Operating Systems
 ---------------------------
-
 Wifite is designed specifically for the latest version of [**Kali** Linux](https://www.kali.org/). [ParrotSec](https://www.parrotsec.org/) is also supported.
 
-Other pen-testing distributions (such as BackBox) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*.
+Other pen-testing distributions (such as BackBox or Ubuntu) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the *Required Tools*, and also [patched wireless drivers that support injection]().
 
 Required Tools
 --------------
-
-First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards)). There are many cheap wireless cards that plug into USB available from online stores.
+First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see [this tutorial for checking if your wireless card is compatible](http://www.aircrack-ng.org/doku.php?id=compatible_cards) and also [this guide](https://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup#Offline_brute-force_attack)). There are many cheap wireless cards that plug into USB available from online stores.
 
 Second, only the latest versions of these programs are supported and must be installed for Wifite to work properly:
 
 **Required:**
 
+* `python`: Wifite is compatible with both `python2` and `python3`.
 * [`iwconfig`](https://wiki.debian.org/iwconfig): For identifying wireless devices already in Monitor Mode.
 * [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig): For starting/stopping wireless devices.
 * [`Aircrack-ng`](http://aircrack-ng.org/) suite, includes:
@@ -43,9 +41,9 @@ Second, only the latest versions of these programs are supported and must be ins
 **Optional, but Recommended:**
 
 * [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html): For detecting WPS networks and inspecting handshake capture files.
-* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust attacks.
+* [`reaver`](https://github.com/t6x/reaver-wps-fork-t6x): For WPS Pixie-Dust & brute-force attacks.
    * Note: Reaver's `wash` tool can be used to detect WPS networks if `tshark` is not found.
-* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust attacks.
+* [`bully`](https://github.com/aanarchyy/bully): For WPS Pixie-Dust & brute-force attacks.
    * Alternative to Reaver. Specify `--bully` to use Bully instead of Reaver.
    * Bully is also used to fetch PSK if `reaver` cannot after cracking WPS PIN.
 * [`coWPAtty`](https://tools.kali.org/wireless-attacks/cowpatty): For detecting handshake captures.
@@ -54,18 +52,17 @@ Second, only the latest versions of these programs are supported and must be ins
    * [`hcxdumptool`](https://github.com/ZerBea/hcxdumptool): For capturing PMKID hashes.
    * [`hcxpcaptool`](https://github.com/ZerBea/hcxtools): For converting PMKID packet captures into `hashcat`'s format.
 
+
 Run Wifite
 ----------
-
 ```
 git clone https://github.com/derv82/wifite2.git
 cd wifite2
-python -m wifite
+sudo ./Wifite.py
 ```
 
 Install Wifite
 --------------
-
 To install onto your computer (so you can just run `wifite` from any terminal), run:
 
 ```bash
@@ -84,24 +81,23 @@ sudo python setup.py install --record files.txt \
 
 Brief Feature List
 ------------------
-
 * [PMKID hash capture](https://hashcat.net/forum/thread-7717.html) (enabled by-default, force with: `--pmkid`)
-* Reaver (or `-bully`) WPS Pixie-Dust attack (enabled by-default, force with: `--wps-only`)
-* WPA handshake capture (enabled by-default, force with: `--no-wps`)
+* WPS Offline Brute-Force Attack aka "Pixie-Dust". (enabled by-default, force with: `--wps-only --pixie`)
+* WPS Online Brute-Force Attack aka "PIN attack". (enabled by-default, force with: `--wps-only --no-pixie`)
+* WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture (enabled by-default, force with: `--no-wps`)
 * Validates handshakes against `pyrit`, `tshark`, `cowpatty`, and `aircrack-ng` (when available)
 * Various WEP attacks (replay, chopchop, fragment, hirte, p0841, caffe-latte)
 * Automatically decloaks hidden access points while scanning or attacking.
-   * Note: Only works when channel is fixed. Use the `-c <channel>` switch.
-   * Disable this via `--no-deauths` switch
+   * Note: Only works when channel is fixed. Use `-c <channel>`
+   * Disable this using `--no-deauths`
 * 5Ghz support for some wireless cards (via `-5` switch).
    * Note: Some tools don't play well on 5GHz channels (e.g. `aireplay-ng`)
 * Stores cracked passwords and handshakes to the current directory (`--cracked`)
-   * Includes metadata about the access point.
+   * Includes information about the cracked access point (Name, BSSID, Date, etc).
 * Easy to try to crack handshakes or PMKID hashes against a wordlist (`--crack`)
 
 What's new?
 -----------
-
 Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
 
 * **Less bugs**
@@ -121,36 +117,35 @@ Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite
 
 What's gone?
 ------------
-
-* No more WPS PIN attack, because it can take days on-average.
-   * However, this feature may be added back into Wiite2 (See [#90](https://github.com/derv82/wifite2/issues/90))
-   * And the Pixie-Dust attack is still an option.
 * Some command-line arguments (`--wept`, `--wpst`, and other confusing switches).
    * You can still access some of these obscure options, try `wifite -h -v`
 
 What's not new?
 ---------------
-
 * (Mostly) Backwards compatible with the original `wifite`'s arguments.
 * Same text-based interface everyone knows and loves.
 
 Screenshots
 -----------
+Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then fetching WPA key using `bully`:
+![Pixie-Dust with Reaver to get PIN and Bully to get PSK](https://i.imgur.com/Q5KSDbg.gif)
 
-Cracking WPS PIN using `reaver`'s Pixie-Dust attack, then retrieving WPA PSK using `bully`:
-![Pixie-Dust with Reaver to get PIN and Bully to get PSK](https://i.imgur.com/I2W0wND.gif)
+-------------
+
+Cracking WPA key using PMKID attack:
+![PMKID attack](https://i.imgur.com/CR8oOp0.gif)
 
 -------------
 
 Decloaking & cracking a hidden access point (via the WPA Handshake attack):
-![Decloaking and Cracking a hidden access point](http://i.imgur.com/MTMwSzM.gif)
+![Decloaking and Cracking a hidden access point](https://i.imgur.com/F6VPhbm.gif)
 
 -------------
 
 Cracking a weak WEP password (using the WEP Replay attack):
-![Cracking a weak WEP password](http://i.imgur.com/VIeltx9.gif)
+![Cracking a weak WEP password](https://i.imgur.com/jP72rVo.gif)
 
 -------------
 
-Various cracking options (using `--crack` option):
-![--crack option](http://i.imgur.com/rydOakW.png)
+Cracking a pre-captured handshake using John The Ripper (via the `--crack` option):
+![--crack option](https://i.imgur.com/iHcfCjp.gif)

wifite/__main__.py

@@ -96,7 +96,7 @@ def entry_point():
         Color.pl('\n{!} {R}Exiting{W}\n')
 
     except KeyboardInterrupt:
-        Color.pl('\n{!} {O}interrupted, shutting down...{W}')
+        Color.pl('\n{!} {O}Interrupted, Shutting down...{W}')
 
     Configuration.exit_gracefully(0)
 

wifite/args.py

@@ -24,25 +24,15 @@ class Arguments(object):
         ''' Returns parser.args() containing all program arguments '''
 
         parser = argparse.ArgumentParser(usage=argparse.SUPPRESS,
-                formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=80, width=130))
+                formatter_class=lambda prog: argparse.HelpFormatter(
+                    prog, max_help_position=80, width=130))
 
-        glob = parser.add_argument_group('SETTINGS')
-        self._add_global_args(glob)
-
-        wep_group = parser.add_argument_group('WEP')
-        self._add_wep_args(wep_group)
-
-        wpa_group = parser.add_argument_group('WPA')
-        self._add_wpa_args(wpa_group)
-
-        wps_group = parser.add_argument_group('WPS')
-        self._add_wps_args(wps_group)
-
-        eviltwin_group = parser.add_argument_group('EVIL TWIN')
-        self._add_eviltwin_args(eviltwin_group)
-
-        commands_group = parser.add_argument_group('COMMANDS')
-        self._add_command_args(commands_group)
+        self._add_global_args(parser.add_argument_group(Color.s('{C}SETTINGS{W}')))
+        self._add_wep_args(parser.add_argument_group(Color.s('{C}WEP{W}')))
+        self._add_wpa_args(parser.add_argument_group(Color.s('{C}WPA{W}')))
+        self._add_wps_args(parser.add_argument_group(Color.s('{C}WPS{W}')))
+        self._add_eviltwin_args(parser.add_argument_group(Color.s('{C}EVIL TWIN{W}')))
+        self._add_command_args(parser.add_argument_group(Color.s('{C}COMMANDS{W}')))
 
         return parser.parse_args()
 
@@ -53,22 +43,32 @@ class Arguments(object):
             action='count',
             default=0,
             dest='verbose',
-            help=Color.s('Shows more options ({C}-h -v{W}). Prints commands and outputs. (default: {G}quiet{W})'))
+            help=Color.s('Shows more options ({C}-h -v{W}). Prints commands and ' +
+                'outputs. (default: {G}quiet{W})'))
 
         glob.add_argument('-i',
             action='store',
             dest='interface',
             metavar='[interface]',
             type=str,
-            help=Color.s('Wireless interface to use (default: {G}choose first or ask{W})'))
+            help=Color.s('Wireless interface to use, e.g. {C}wlan0mon{W} ' +
+                '(default: {G}ask{W})'))
 
         glob.add_argument('-c',
             action='store',
             dest='channel',
             metavar='[channel]',
             type=int,
-            help=Color.s('Wireless channel to scan (default: {G}all channels{W})'))
-        glob.add_argument('--channel', help=argparse.SUPPRESS, action='store', dest='channel', type=int)
+            help=Color.s('Wireless channel to scan (default: {G}all 2Ghz channels{W})'))
+        glob.add_argument('--channel', help=argparse.SUPPRESS, action='store',
+                dest='channel', type=int)
+
+        glob.add_argument('-5',
+            '--5ghz',
+            action='store_true',
+            dest='five_ghz',
+            help=self._verbose('Include 5Ghz channels (default: {G}off{W})'))
+
 
         glob.add_argument('-mac',
             '--random-mac',
@@ -81,29 +81,28 @@ class Arguments(object):
             dest='scan_time',
             nargs='?',
             const=10,
-            metavar='scantime',
+            metavar='scan_time',
             type=int,
-            help=Color.s('{G}Pillage{W}: Attack all targets after {C}scantime{W} seconds'))
-        glob.add_argument('--pillage', help=argparse.SUPPRESS, action='store', dest='scan_time', nargs='?', const=10, type=int)
+            help=Color.s('{G}Pillage{W}: Attack all targets after ' +
+                '{C}scan_time{W} (seconds)'))
+        glob.add_argument('--pillage', help=argparse.SUPPRESS, action='store',
+                dest='scan_time', nargs='?', const=10, type=int)
 
         glob.add_argument('--kill',
             action='store_true',
             dest='kill_conflicting_processes',
-            help=Color.s('Kill processes that conflict with Airmon/Airodump (default: {G}off{W})'))
-
-        glob.add_argument('-5',
-            '--5ghz',
-            action='store_true',
-            dest='five_ghz',
-            help=self._verbose('Include 5Ghz channels (default: {G}off{W})'))
+            help=Color.s('Kill processes that conflict with Airmon/Airodump ' +
+                '(default: {G}off{W})'))
 
         glob.add_argument('-b',
             action='store',
             dest='target_bssid',
             metavar='[bssid]',
             type=str,
-            help=self._verbose('BSSID (e.g. {GR}AA:BB:CC:DD:EE:FF{W}) of access point to attack'))
-        glob.add_argument('--bssid', help=argparse.SUPPRESS, action='store', dest='target_bssid', type=str)
+            help=self._verbose('BSSID (e.g. {GR}AA:BB:CC:DD:EE:FF{W}) of access ' +
+                'point to attack'))
+        glob.add_argument('--bssid', help=argparse.SUPPRESS, action='store',
+                dest='target_bssid', type=str)
 
         glob.add_argument('-e',
             action='store',
@@ -111,7 +110,8 @@ class Arguments(object):
             metavar='[essid]',
             type=str,
             help=self._verbose('ESSID (e.g. {GR}NETGEAR07{W}) of access point to attack'))
-        glob.add_argument('--essid', help=argparse.SUPPRESS, action='store', dest='target_essid', type=str)
+        glob.add_argument('--essid', help=argparse.SUPPRESS, action='store',
+                dest='target_essid', type=str)
 
         glob.add_argument('-E',
             action='store',
@@ -120,12 +120,14 @@ class Arguments(object):
             type=str,
             default=None,
             help=self._verbose('Hides targets with ESSIDs that match the given text'))
-        glob.add_argument('--ignore-essid', help=argparse.SUPPRESS, action='store', dest='ignore_essid', type=str)
+        glob.add_argument('--ignore-essid', help=argparse.SUPPRESS, action='store',
+                dest='ignore_essid', type=str)
 
-        glob.add_argument('--clients-only', '-co',
+        glob.add_argument('--clients-only',
             action='store_true',
             dest='clients_only',
-            help=Color.s('Only show targets that have associated clients (default: {G}off{W})'))
+            help=Color.s('Only show targets that have associated clients ' +
+                '(default: {G}off{W})'))
 
         glob.add_argument('--showb',
             action='store_true',
@@ -135,9 +137,12 @@ class Arguments(object):
         glob.add_argument('--nodeauths',
             action='store_true',
             dest='no_deauth',
-            help=Color.s('Passive mode: Never deauthenticates clients (default: {G}deauth targets{W})'))
-        glob.add_argument('--no-deauths', action='store_true', dest='no_deauth', help=argparse.SUPPRESS)
-        glob.add_argument('-nd',          action='store_true', dest='no_deauth', help=argparse.SUPPRESS)
+            help=Color.s('Passive mode: Never deauthenticates clients ' +
+                '(default: {G}deauth targets{W})'))
+        glob.add_argument('--no-deauths', action='store_true', dest='no_deauth',
+                help=argparse.SUPPRESS)
+        glob.add_argument('-nd',          action='store_true', dest='no_deauth',
+                help=argparse.SUPPRESS)
 
         glob.add_argument('--num-deauths',
             action='store',
@@ -145,7 +150,8 @@ class Arguments(object):
             dest='num_deauths',
             metavar='[num]',
             default=None,
-            help=self._verbose('Number of deauth packets to send (default: {G}%d{W})' % self.config.num_deauths))
+            help=self._verbose('Number of deauth packets to send (default: ' +
+                '{G}%d{W})' % self.config.num_deauths))
 
 
     def _add_eviltwin_args(self, group):
@@ -154,7 +160,8 @@ class Arguments(object):
         group.add_argument('--eviltwin',
             action='store_true',
             dest='use_eviltwin',
-            help=Color.s('Use the "Evil Twin" attack against all targets (default: {G}off{W})'))
+            help=Color.s('Use the "Evil Twin" attack against all targets ' +
+                '(default: {G}off{W})'))
         # TODO: Args to specify deauth interface, server port, etc.
         '''
 
@@ -164,140 +171,159 @@ class Arguments(object):
         wep.add_argument('--wep',
             action='store_true',
             dest='wep_filter',
-            help=Color.s('Filter to display only WEP-encrypted networks (default: {G}off{W})'))
-        wep.add_argument('-wep', help=argparse.SUPPRESS, action='store_true', dest='wep_filter')
+            help=Color.s('Show only {C}WEP-encrypted networks{W}'))
+        wep.add_argument('-wep', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_filter')
 
         wep.add_argument('--require-fakeauth',
             action='store_true',
             dest='require_fakeauth',
-            help=Color.s('Fails attacks if fake-auth fails (default: {G}off{W})'))
-        wep.add_argument('--nofakeauth', help=argparse.SUPPRESS, action='store_true', dest='require_fakeauth')
-        wep.add_argument('-nofakeauth', help=argparse.SUPPRESS, action='store_true', dest='require_fakeauth')
+            help=Color.s('Fails attacks if {C}fake-auth{W} fails (default: {G}off{W})'))
+        wep.add_argument('--nofakeauth', help=argparse.SUPPRESS, action='store_true',
+                dest='require_fakeauth')
+        wep.add_argument('-nofakeauth', help=argparse.SUPPRESS, action='store_true',
+                dest='require_fakeauth')
 
         wep.add_argument('--keep-ivs',
             action='store_true',
             dest='wep_keep_ivs',
             default=False,
-            help=Color.s('Retain .IVS files and reuse when cracking (default: {G}off{W})'))
+            help=Color.s('Retain .IVS files and reuse when cracking ' +
+                '(default: {G}off{W})'))
 
         wep.add_argument('--pps',
             action='store',
             dest='wep_pps',
             metavar='[pps]',
             type=int,
-            help=self._verbose('Packets Per Second to replay (default: {G}%d pps{W})' % self.config.wep_pps))
-        wep.add_argument('-pps', help=argparse.SUPPRESS, action='store', dest='wep_pps', type=int)
+            help=self._verbose('Packets-per-second to replay (default: ' +
+                '{G}%d pps{W})' % self.config.wep_pps))
+        wep.add_argument('-pps', help=argparse.SUPPRESS, action='store',
+                dest='wep_pps', type=int)
 
         wep.add_argument('--wept',
             action='store',
             dest='wep_timeout',
             metavar='[seconds]',
             type=int,
-            help=self._verbose('Seconds to wait before failing (default: {G}%d sec{W})' % self.config.wep_timeout))
-        wep.add_argument('-wept', help=argparse.SUPPRESS, action='store', dest='wep_timeout', type=int)
+            help=self._verbose('Seconds to wait before failing (default: ' +
+                '{G}%d sec{W})' % self.config.wep_timeout))
+        wep.add_argument('-wept', help=argparse.SUPPRESS, action='store',
+                dest='wep_timeout', type=int)
 
         wep.add_argument('--wepca',
             action='store',
             dest='wep_crack_at_ivs',
             metavar='[ivs]',
             type=int,
-            help=self._verbose('Start cracking at this many IVs (default: {G}%d ivs{W})' % self.config.wep_crack_at_ivs))
-        wep.add_argument('-wepca', help=argparse.SUPPRESS, action='store', dest='wep_crack_at_ivs', type=int)
+            help=self._verbose('Start cracking at this many IVs (default: ' +
+                '{G}%d ivs{W})' % self.config.wep_crack_at_ivs))
+        wep.add_argument('-wepca', help=argparse.SUPPRESS, action='store',
+                dest='wep_crack_at_ivs', type=int)
 
         wep.add_argument('--weprs',
             action='store',
             dest='wep_restart_stale_ivs',
             metavar='[seconds]',
             type=int,
-            help=self._verbose('Restart aireplay if no new IVs appear (default: {G}%d sec{W})' % self.config.wep_restart_stale_ivs))
-        wep.add_argument('-weprs', help=argparse.SUPPRESS, action='store', dest='wep_restart_stale_ivs', type=int)
+            help=self._verbose('Restart aireplay if no new IVs appear (default: ' +
+                '{G}%d sec{W})' % self.config.wep_restart_stale_ivs))
+        wep.add_argument('-weprs', help=argparse.SUPPRESS, action='store',
+                dest='wep_restart_stale_ivs', type=int)
 
         wep.add_argument('--weprc',
             action='store',
             dest='wep_restart_aircrack',
             metavar='[seconds]',
             type=int,
-            help=self._verbose('Restart aircrack after this delay (default: {G}%d sec{W})' % self.config.wep_restart_aircrack))
-        wep.add_argument('-weprc', help=argparse.SUPPRESS, action='store', dest='wep_restart_aircrack', type=int)
+            help=self._verbose('Restart aircrack after this delay (default: ' +
+                '{G}%d sec{W})' % self.config.wep_restart_aircrack))
+        wep.add_argument('-weprc', help=argparse.SUPPRESS, action='store',
+                dest='wep_restart_aircrack', type=int)
 
         wep.add_argument('--arpreplay',
             action='store_true',
             dest='wep_attack_replay',
-            help=self._verbose('Use ARP-replay WEP attack (default: {G}on{W})'))
-        wep.add_argument('-arpreplay', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_replay')
+            help=self._verbose('Use {C}ARP-replay{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-arpreplay', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_replay')
 
         wep.add_argument('--fragment',
             action='store_true',
             dest='wep_attack_fragment',
-            help=self._verbose('Use fragmentation WEP attack (default: {G}on{W})'))
-        wep.add_argument('-fragment', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_fragment')
+            help=self._verbose('Use {C}fragmentation{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-fragment', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_fragment')
 
         wep.add_argument('--chopchop',
             action='store_true',
             dest='wep_attack_chopchop',
-            help=self._verbose('Use chop-chop WEP attack (default: {G}on{W})'))
-        wep.add_argument('-chopchop', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_chopchop')
+            help=self._verbose('Use {C}chop-chop{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-chopchop', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_chopchop')
 
         wep.add_argument('--caffelatte',
             action='store_true',
             dest='wep_attack_caffe',
-            help=self._verbose('Use caffe-latte WEP attack (default: {G}on{W})'))
-        wep.add_argument('-caffelatte', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_caffelatte')
+            help=self._verbose('Use {C}caffe-latte{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-caffelatte', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_caffelatte')
 
         wep.add_argument('--p0841',
             action='store_true',
             dest='wep_attack_p0841',
-            help=self._verbose('Use p0841 WEP attack (default: {G}on{W})'))
-        wep.add_argument('-p0841', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_p0841')
+            help=self._verbose('Use {C}p0841{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-p0841', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_p0841')
 
         wep.add_argument('--hirte',
             action='store_true',
             dest='wep_attack_hirte',
-            help=self._verbose('Use ARP-replay WEP attack (default: {G}on{W})'))
-        wep.add_argument('-hirte', help=argparse.SUPPRESS, action='store_true', dest='wep_attack_hirte')
+            help=self._verbose('Use {C}hirte{W} WEP attack (default: {G}on{W})'))
+        wep.add_argument('-hirte', help=argparse.SUPPRESS, action='store_true',
+                dest='wep_attack_hirte')
 
 
     def _add_wpa_args(self, wpa):
         wpa.add_argument('--wpa',
             action='store_true',
             dest='wpa_filter',
-            help=Color.s('Filter to display only WPA-encrypted networks (includes WPS)'))
-        wpa.add_argument('-wpa', help=argparse.SUPPRESS, action='store_true', dest='wpa_filter')
-
-        wpa.add_argument('--wpadt',
-            action='store',
-            dest='wpa_deauth_timeout',
-            metavar='[seconds]',
-            type=int,
-            help=self._verbose('Time to wait between sending Deauths (default: {G}%d sec{W})' % self.config.wpa_deauth_timeout))
-        wpa.add_argument('-wpadt', help=argparse.SUPPRESS, action='store', dest='wpa_deauth_timeout', type=int)
-
-        wpa.add_argument('--wpat',
-            action='store',
-            dest='wpa_attack_timeout',
-            metavar='[seconds]',
-            type=int,
-            help=self._verbose('Time to wait before failing WPA attack (default: {G}%d sec{W})' % self.config.wpa_attack_timeout))
-        wpa.add_argument('-wpat', help=argparse.SUPPRESS, action='store', dest='wpa_attack_timeout', type=int)
+            help=Color.s('Show only {C}WPA-encrypted networks{W} (includes {C}WPS{W})'))
+        wpa.add_argument('-wpa', help=argparse.SUPPRESS, action='store_true',
+                dest='wpa_filter')
 
         wpa.add_argument('--pmkid',
-            '-pmkid',
             action='store_true',
             dest='use_pmkid_only',
-            help=Color.s('ONLY use PMKID capture on WPA endpoints (default: {G}off{W})'))
+            help=Color.s('{O}Only{W} use {C}PMKID capture{W}, avoids other WPS & ' +
+                'WPA attacks (default: {G}off{W})'))
+        # Alias
+        wpa.add_argument('-pmkid', action='store_true', dest='use_pmkid_only',
+            help=argparse.SUPPRESS)
 
-        wpa.add_argument('--new-hs',
-            action='store_true',
-            dest='ignore_old_handshakes',
-            help=Color.s('Captures new handshakes, ignores existing handshakes in ./hs (default: {G}off{W})'))
+        wpa.add_argument('--pmkid-timeout',
+            action='store',
+            dest='pmkid_timeout',
+            metavar='[sec]',
+            type=int,
+            help=self._verbose('Time to wait for PMKID capture ' +
+                '(default: {G}%d{W} seconds)' % self.config.pmkid_timeout))
 
         wpa.add_argument('--hs-dir',
             action='store',
             dest='wpa_handshake_dir',
             metavar='[dir]',
             type=str,
-            help=self._verbose('Directory to store handshake files (default: {G}%s{W})' % self.config.wpa_handshake_dir))
-        wpa.add_argument('-hs-dir', help=argparse.SUPPRESS, action='store', dest='wpa_handshake_dir', type=str)
+            help=self._verbose('Directory to store handshake files ' +
+                '(default: {G}%s{W})' % self.config.wpa_handshake_dir))
+        wpa.add_argument('-hs-dir', help=argparse.SUPPRESS, action='store',
+                dest='wpa_handshake_dir', type=str)
+
+        wpa.add_argument('--new-hs',
+            action='store_true',
+            dest='ignore_old_handshakes',
+            help=Color.s('Captures new handshakes, ignores existing handshakes ' +
+                'in {C}%s{W} (default: {G}off{W})' % self.config.wpa_handshake_dir))
 
         wpa.add_argument('--dict',
             action='store',
@@ -307,6 +333,26 @@ class Arguments(object):
             help=Color.s('File containing passwords for cracking (default: {G}%s{W})')
                 % self.config.wordlist)
 
+        wpa.add_argument('--wpadt',
+            action='store',
+            dest='wpa_deauth_timeout',
+            metavar='[seconds]',
+            type=int,
+            help=self._verbose('Time to wait between sending Deauths ' +
+                '(default: {G}%d sec{W})' % self.config.wpa_deauth_timeout))
+        wpa.add_argument('-wpadt', help=argparse.SUPPRESS, action='store',
+                dest='wpa_deauth_timeout', type=int)
+
+        wpa.add_argument('--wpat',
+            action='store',
+            dest='wpa_attack_timeout',
+            metavar='[seconds]',
+            type=int,
+            help=self._verbose('Time to wait before failing WPA attack ' +
+                '(default: {G}%d sec{W})' % self.config.wpa_attack_timeout))
+        wpa.add_argument('-wpat', help=argparse.SUPPRESS, action='store',
+                dest='wpa_attack_timeout', type=int)
+
         # TODO: Uncomment the --strip option once it works
         '''
         wpa.add_argument('--strip',
@@ -315,34 +361,51 @@ class Arguments(object):
             default=False,
             help=Color.s('Strip unnecessary packets from handshake capture using tshark'))
         '''
-        wpa.add_argument('-strip', help=argparse.SUPPRESS, action='store_true', dest='wpa_strip_handshake')
+        wpa.add_argument('-strip', help=argparse.SUPPRESS, action='store_true',
+                dest='wpa_strip_handshake')
 
 
     def _add_wps_args(self, wps):
         wps.add_argument('--wps',
             action='store_true',
             dest='wps_filter',
-            help=Color.s('Filter to display only WPS-enabled networks'))
-        wps.add_argument('-wps', help=argparse.SUPPRESS, action='store_true', dest='wps_filter')
-
-        wps.add_argument('--bully',
-            action='store_true',
-            dest='use_bully',
-            help=Color.s('Use {C}bully{W} instead of {C}reaver{W} for WPS attacks (default: {G}reaver{W})'))
-        # Alias
-        wps.add_argument('-bully', help=argparse.SUPPRESS, action='store_true', dest='use_bully')
+            help=Color.s('Show only {C}WPS-enabled networks{W}'))
+        wps.add_argument('-wps', help=argparse.SUPPRESS, action='store_true',
+                dest='wps_filter')
 
         wps.add_argument('--no-wps',
             action='store_true',
             dest='no_wps',
-            help=Color.s('{O}NEVER{W} use WPS attacks (Pixie-Dust) on non-WEP networks (default: {G}off{W})'))
+            help=self._verbose('{O}Never{W} use {O}WPS PIN{W} & {O}Pixie-Dust{W}' +
+                'attacks on targets (default: {G}off{W})'))
 
         wps.add_argument('--wps-only',
             action='store_true',
             dest='wps_only',
-            help=Color.s('{G}ALWAYS{W} use WPS attacks (Pixie-Dust) on non-WEP networks (default: {G}off{W})'))
+            help=Color.s('{O}Only{W} use {C}WPS PIN{W} & {C}Pixie-Dust{W} ' +
+                'attacks (default: {G}off{W})'))
+
+        wps.add_argument('--pixie',    action='store_true', dest='wps_pixie',
+            help=self._verbose('{O}Only{W} use {C}WPS Pixie-Dust{W} attack ' +
+                '(do not use {O}PIN attack{W})'))
+
+        wps.add_argument('--no-pixie', action='store_true', dest='wps_no_pixie',
+            help=self._verbose('{O}Never{W} use {O}WPS Pixie-Dust{W} attack ' +
+                '(use {G}PIN attack{W})'))
+
+        wps.add_argument('--bully',
+            action='store_true',
+            dest='use_bully',
+            help=Color.s('Use {G}bully{W} program for WPS PIN & Pixie-Dust attacks ' +
+                '(default: {G}reaver{W})'))
         # Alias
-        wps.add_argument('--pixie', help=argparse.SUPPRESS, action='store_true', dest='wps_only')
+        wps.add_argument('-bully', help=argparse.SUPPRESS, action='store_true',
+                dest='use_bully')
+
+        # Ignore lock-outs
+        wps.add_argument('--ignore-locks', action='store_true', dest='wps_ignore_lock',
+            help=Color.s('Do {O}not{W} stop WPS PIN attack if AP becomes {O}locked{W} ' +
+                ' (default: {G}stop{W})'))
 
         # Time limit on entire attack.
         wps.add_argument('--wps-time',
@@ -350,9 +413,11 @@ class Arguments(object):
             dest='wps_pixie_timeout',
             metavar='[sec]',
             type=int,
-            help=self._verbose('Total time to wait before failing PixieDust attack (default: {G}%d sec{W})' % self.config.wps_pixie_timeout))
+            help=self._verbose('Total time to wait before failing PixieDust attack ' +
+                '(default: {G}%d sec{W})' % self.config.wps_pixie_timeout))
         # Alias
-        wps.add_argument('-wpst', help=argparse.SUPPRESS, action='store', dest='wps_pixie_timeout', type=int)
+        wps.add_argument('-wpst', help=argparse.SUPPRESS, action='store',
+                dest='wps_pixie_timeout', type=int)
 
         # Maximum number of 'failures' (WPSFail)
         wps.add_argument('--wps-fails',
@@ -360,9 +425,11 @@ class Arguments(object):
             dest='wps_fail_threshold',
             metavar='[num]',
             type=int,
-            help=self._verbose('Maximum number of WPSFail/NoAssoc errors before failing (default: {G}%d{W})' % self.config.wps_fail_threshold))
+            help=self._verbose('Maximum number of WPSFail/NoAssoc errors before ' +
+                'failing (default: {G}%d{W})' % self.config.wps_fail_threshold))
         # Alias
-        wps.add_argument('-wpsf', help=argparse.SUPPRESS, action='store', dest='wps_fail_threshold', type=int)
+        wps.add_argument('-wpsf', help=argparse.SUPPRESS, action='store',
+                dest='wps_fail_threshold', type=int)
 
         # Maximum number of 'timeouts'
         wps.add_argument('--wps-timeouts',
@@ -370,17 +437,20 @@ class Arguments(object):
             dest='wps_timeout_threshold',
             metavar='[num]',
             type=int,
-            help=self._verbose('Maximum number of Timeouts before failing (default: {G}%d{W})' % self.config.wps_timeout_threshold))
+            help=self._verbose('Maximum number of Timeouts before failing ' +
+                '(default: {G}%d{W})' % self.config.wps_timeout_threshold))
         # Alias
-        wps.add_argument('-wpsto', help=argparse.SUPPRESS, action='store', dest='wps_timeout_threshold', type=int)
+        wps.add_argument('-wpsto', help=argparse.SUPPRESS, action='store',
+                dest='wps_timeout_threshold', type=int)
 
 
     def _add_command_args(self, commands):
         commands.add_argument('--cracked',
             action='store_true',
             dest='cracked',
-            help=Color.s('Display previously-cracked access points'))
-        commands.add_argument('-cracked', help=argparse.SUPPRESS, action='store_true', dest='cracked')
+            help=Color.s('Print previously-cracked access points'))
+        commands.add_argument('-cracked', help=argparse.SUPPRESS, action='store_true',
+                dest='cracked')
 
         commands.add_argument('--check',
             action='store',
@@ -388,8 +458,10 @@ class Arguments(object):
             nargs='?',
             const='<all>',
             dest='check_handshake',
-            help=Color.s('Check a .cap file (or all hs/*.cap files) for WPA handshakes'))
-        commands.add_argument('-check', help=argparse.SUPPRESS, action='store', nargs='?', const='<all>', dest='check_handshake')
+            help=Color.s('Check a {C}.cap file{W} (or all {C}hs/*.cap{W} files) ' +
+                'for WPA handshakes'))
+        commands.add_argument('-check', help=argparse.SUPPRESS, action='store',
+                nargs='?', const='<all>', dest='check_handshake')
 
         commands.add_argument('--crack',
             action='store_true',

wifite/attack/all.py

@@ -1,6 +1,10 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
+from .wep import AttackWEP
+from .wpa import AttackWPA
+from .wps import AttackWPS
+from .pmkid import AttackPMKID
 from ..config import Configuration
 from ..util.color import Color
 
@@ -12,6 +16,10 @@ class AttackAll(object):
         Attacks all given `targets` (list[wifite.model.target]) until user interruption.
         Returns: Number of targets that were attacked (int)
         '''
+        if any(t.wps for t in targets) and not AttackWPS.can_attack_wps():
+            # Warn that WPS attacks are not available.
+            Color.pl('{!} {O}Note: WPS attacks are not possible because you do not have {C}reaver{O} nor {C}bully{W}')
+
         attacked_targets = 0
         targets_remaining = len(targets)
         for index, target in enumerate(targets, start=1):
@@ -22,7 +30,7 @@ class AttackAll(object):
             essid = target.essid if target.essid_known else '{O}ESSID unknown{W}'
 
             Color.pl('\n{+} ({G}%d{W}/{G}%d{W})' % (index, len(targets)) +
-                     ' starting attacks against {C}%s{W} ({C}%s{W})' % (bssid, essid))
+                     ' Starting attacks against {C}%s{W} ({C}%s{W})' % (bssid, essid))
 
             should_continue = cls.attack_single(target, targets_remaining)
             if not should_continue:
@@ -36,10 +44,6 @@ class AttackAll(object):
         Attacks a single `target` (wifite.model.target).
         Returns: True if attacks should continue, False otherwise.
         '''
-        from .wep import AttackWEP
-        from .wpa import AttackWPA
-        from .wps import AttackWPS
-        from .pmkid import AttackPMKID
 
         attacks = []
 
@@ -53,19 +57,28 @@ class AttackAll(object):
         elif 'WPA' in target.encryption:
             # WPA can have multiple attack vectors:
 
-            if target.wps:
-                # WPS
-                attacks.append(AttackWPS(target))
+            # WPS
+            if not Configuration.use_pmkid_only:
+                if target.wps != False and AttackWPS.can_attack_wps():
+                    # Pixie-Dust
+                    if Configuration.wps_pixie:
+                        attacks.append(AttackWPS(target, pixie_dust=True))
 
-            # PMKID
-            attacks.append(AttackPMKID(target))
+                    # PIN attack
+                    if Configuration.wps_pin:
+                        attacks.append(AttackWPS(target, pixie_dust=False))
 
-            # Handshake capture
-            attacks.append(AttackWPA(target))
+            if not Configuration.wps_only:
+                # PMKID
+                attacks.append(AttackPMKID(target))
+
+                # Handshake capture
+                if not Configuration.use_pmkid_only:
+                    attacks.append(AttackWPA(target))
 
         if len(attacks) == 0:
-            Color.pl('{!} {R}Error: {O}unable to attack: encryption not WEP or WPA')
-            return
+            Color.pl('{!} {R}Error: {O}Unable to attack: no attacks available')
+            return True  # Keep attacking other targets (skip)
 
         while len(attacks) > 0:
             attack = attacks.pop(0)
@@ -77,9 +90,14 @@ class AttackAll(object):
                 Color.pexception(e)
                 continue
             except KeyboardInterrupt:
-                Color.pl('\n{!} {O}interrupted{W}\n')
-                if not cls.user_wants_to_continue(targets_remaining, len(attacks)):
-                    return False  # Stop attacking other targets
+                Color.pl('\n{!} {O}Interrupted{W}\n')
+                answer = cls.user_wants_to_continue(targets_remaining, len(attacks))
+                if answer is True:
+                    continue  # Keep attacking the same target (continue)
+                elif answer is None:
+                    return True  # Keep attacking other targets (skip)
+                else:
+                    return False  # Stop all attacks (exit)
 
         if attack.success:
             attack.crack_result.save()
@@ -102,15 +120,30 @@ class AttackAll(object):
             prompt_list.append(Color.s('{C}%d{W} attack(s)' % attacks_remaining))
         if targets_remaining > 0:
             prompt_list.append(Color.s('{C}%d{W} target(s)' % targets_remaining))
-        prompt = ' and '.join(prompt_list)
-        Color.pl('{+} %s remain, do you want to continue?' % prompt)
+        prompt = ' and '.join(prompt_list) + ' remain'
+        Color.pl('{+} %s' % prompt)
 
-        prompt = Color.s('{+} type {G}c{W} to {G}continue{W}' +
-                         ' or {R}s{W} to {R}stop{W}: ')
+        prompt = '{+} Do you want to'
+        options = '('
+
+        if attacks_remaining > 0:
+            prompt += ' {G}continue{W} attacking,'
+            options += '{G}C{W}{D}, {W}'
+
+        if targets_remaining > 0:
+            prompt += ' {O}skip{W} to the next target,'
+            options += '{O}s{W}{D}, {W}'
+
+        options += '{R}e{W})'
+        prompt += ' or {R}exit{W} %s? {C}' % options
 
         from ..util.input import raw_input
-        if raw_input(prompt).lower().startswith('s'):
-            return False
-        else:
-            return True
+        answer = raw_input(Color.s(prompt)).lower()
+
+        if answer.startswith('s'):
+            return None  # Skip
+        elif answer.startswith('e'):
+            return False  # Exit
+        else:
+            return True  # Continue
 

wifite/attack/pmkid.py

@@ -62,12 +62,6 @@ class AttackPMKID(Attack):
         Returns:
             True if handshake is captured. False otherwise.
         '''
-        # Skip if user only wants to run PixieDust attack
-        if Configuration.wps_only and self.target.wps:
-            Color.pl('\r{!} {O}Skipping PMKID attack on {R}%s{O} because {R}--wps-only{O} is set{W}' % self.target.essid)
-            self.success = False
-            return False
-
         from ..util.process import Process
         # Check that we have all hashcat programs
         dependencies = [
@@ -114,7 +108,7 @@ class AttackPMKID(Attack):
             The PMKID hash (str) if found, otherwise None.
         '''
         self.keep_capturing = True
-        self.timer = Timer(15)
+        self.timer = Timer(Configuration.pmkid_timeout)
 
         # Start hcxdumptool
         t = Thread(target=self.dumptool_thread)
@@ -174,7 +168,6 @@ class AttackPMKID(Attack):
                 Color.clear_entire_line()
                 Color.pattack('PMKID', self.target, '{R}CRACK',
                         '{R}Failed {O}Passphrase not found in dictionary.\n')
-                Color.pl('')
             return False
         else:
             # Successfully cracked.
@@ -192,7 +185,7 @@ class AttackPMKID(Attack):
         dumptool = HcxDumpTool(self.target, self.pcapng_file)
 
         # Let the dump tool run until we have the hash.
-        while self.keep_capturing and dumptool.poll() == None:
+        while self.keep_capturing and dumptool.poll() is None:
             time.sleep(0.5)
 
         dumptool.interrupt()
@@ -202,7 +195,7 @@ class AttackPMKID(Attack):
         '''Saves a copy of the pmkid (handshake) to hs/ directory.'''
         # Create handshake dir
         if not os.path.exists(Configuration.wpa_handshake_dir):
-            os.mkdir(Configuration.wpa_handshake_dir)
+            os.makedirs(Configuration.wpa_handshake_dir)
 
         # Generate filesystem-safe filename from bssid, essid and date
         essid_safe = re.sub('[^a-zA-Z0-9]', '', self.target.essid)

wifite/attack/wpa.py

@@ -27,15 +27,17 @@ class AttackWPA(Attack):
     def run(self):
         '''Initiates full WPA handshake capture attack.'''
 
-        if Configuration.use_pmkid_only:
-            self.success = False
-            return False
-        # Skip if user only wants to run PixieDust attack
-        if Configuration.wps_only and self.target.wps:
+        # Skip if target is not WPS
+        if Configuration.wps_only and self.target.wps == False:
             Color.pl('\r{!} {O}Skipping WPA-Handshake attack on {R}%s{O} because {R}--wps-only{O} is set{W}' % self.target.essid)
             self.success = False
             return self.success
 
+        # Skip if user only wants to run PMKID attack
+        if Configuration.use_pmkid_only:
+            self.success = False
+            return False
+
         # Capture the handshake (or use an old one)
         handshake = self.capture_handshake()
 
@@ -203,7 +205,7 @@ class AttackWPA(Attack):
         '''
         # Create handshake dir
         if not os.path.exists(Configuration.wpa_handshake_dir):
-            os.mkdir(Configuration.wpa_handshake_dir)
+            os.makedirs(Configuration.wpa_handshake_dir)
 
         # Generate filesystem-safe filename from bssid, essid and date
         if handshake.essid and type(handshake.essid) is str:

wifite/attack/wps.py

@@ -3,13 +3,22 @@
 
 from ..model.attack import Attack
 from ..util.color import Color
+from ..util.process import Process
 from ..config import Configuration
+from ..tools.bully import Bully
+from ..tools.reaver import Reaver
 
 class AttackWPS(Attack):
-    def __init__(self, target):
+
+    @staticmethod
+    def can_attack_wps():
+        return Reaver.exists() or Bully.exists()
+
+    def __init__(self, target, pixie_dust=False):
         super(AttackWPS, self).__init__(target)
         self.success = False
         self.crack_result = None
+        self.pixie_dust = pixie_dust
 
     def run(self):
         ''' Run all WPS-related attacks '''
@@ -20,22 +29,47 @@ class AttackWPS(Attack):
             return False
 
         if Configuration.no_wps:
-            Color.pl('\r{!} {O}--no-wps{R} set, ignoring WPS attack on {O}%s{W}' % self.target.essid)
             self.success = False
             return False
 
-        if Configuration.use_bully:
+        if not Configuration.wps_pixie and self.pixie_dust:
+            Color.pl('\r{!} {O}--no-pixie{R} was given, ignoring WPS PIN Attack on ' +
+                    '{O}%s{W}' % self.target.essid)
+            self.success = False
+            return False
+
+        if not Configuration.wps_pin and not self.pixie_dust:
+            Color.pl('\r{!} {O}--no-pin{R} was given, ignoring WPS Pixie-Dust Attack ' +
+                    'on {O}%s{W}' % self.target.essid)
+            self.success = False
+            return False
+
+        if not Reaver.exists() and Bully.exists():
+            # Use bully if reaver isn't available
             return self.run_bully()
+        elif self.pixie_dust and not Reaver.is_pixiedust_supported() and Bully.exists():
+            # Use bully if reaver can't do pixie-dust
+            return self.run_bully()
+        elif Configuration.use_bully:
+            # Use bully if asked by user
+            return self.run_bully()
+        elif not Reaver.exists():
+            # Print error if reaver isn't found (bully not available)
+            if self.pixie_dust:
+                Color.pl('\r{!} {R}Skipping WPS Pixie-Dust attack: {O}reaver{R} not found.{W}')
+            else:
+                Color.pl('\r{!} {R}Skipping WPS PIN attack: {O}reaver{R} not found.{W}')
+            return False
+        elif self.pixie_dust and not Reaver.is_pixiedust_supported():
+            # Print error if reaver can't support pixie-dust (bully not available)
+            Color.pl('\r{!} {R}Skipping WPS attack: {O}reaver{R} does not support {O}--pixie-dust{W}')
+            return False
         else:
             return self.run_reaver()
 
-        return False
-
 
     def run_bully(self):
-        # Bully: Pixie-dust
-        from ..tools.bully import Bully
-        bully = Bully(self.target)
+        bully = Bully(self.target, pixie_dust=self.pixie_dust)
         bully.run()
         bully.stop()
         self.crack_result = bully.crack_result
@@ -44,16 +78,9 @@ class AttackWPS(Attack):
 
 
     def run_reaver(self):
-        from ..tools.reaver import Reaver
-        reaver = Reaver(self.target)
-        if not reaver.is_pixiedust_supported():
-            Color.pl('{!} {R}your version of "reaver" does not support the {O}WPS pixie-dust attack{W}')
-            return False
-        else:
-            # Reaver: Pixie-dust
-            reaver = Reaver(self.target)
-            reaver.run()
-            self.crack_result = reaver.crack_result
-            self.success = self.crack_result is not None
-            return self.success
+        reaver = Reaver(self.target, pixie_dust=self.pixie_dust)
+        reaver.run()
+        self.crack_result = reaver.crack_result
+        self.success = self.crack_result is not None
+        return self.success
 

wifite/config.py

@@ -8,7 +8,7 @@ from .tools.macchanger import Macchanger
 
 class Configuration(object):
     ''' Stores configuration variables and functions for Wifite. '''
-    version = '2.2.2'
+    version = '2.2.5'
 
     initialized = False # Flag indicating config has been initialized
     temp_dir = None     # Temporary directory
@@ -35,7 +35,6 @@ class Configuration(object):
         cls.kill_conflicting_processes = False
 
         cls.scan_time = 0 # Time to wait before attacking all targets
-        cls.all_targets = False # Run attacks against all targets automatically
 
         cls.tx_power = 0 # Wifi transmit power (0 is default)
         cls.interface = None
@@ -80,6 +79,7 @@ class Configuration(object):
         cls.wpa_strip_handshake = False # Strip non-handshake packets
         cls.ignore_old_handshakes = False # Always fetch a new handshake
         cls.use_pmkid_only = False  # Only use PMKID Capture+Crack attack
+        cls.pmkid_timeout = 30  # Time to wait for PMKID capture
 
         # Default dictionary for cracking
         cls.wordlist = None
@@ -102,6 +102,9 @@ class Configuration(object):
         cls.no_wps      = False  # Do not use WPS attacks (Pixie-Dust & PIN attacks)
         cls.wps_only    = False  # ONLY use WPS attacks on non-WEP networks
         cls.use_bully   = False  # Use bully instead of reaver
+        cls.wps_pixie   = True
+        cls.wps_pin     = True
+        cls.wps_ignore_lock = False  # Skip WPS PIN attack if AP is locked.
         cls.wps_pixie_timeout = 300      # Seconds to wait for PIN before WPS Pixie attack fails
         cls.wps_fail_threshold = 100     # Max number of failures
         cls.wps_timeout_threshold = 100  # Max number of timeouts
@@ -127,58 +130,17 @@ class Configuration(object):
             if cls.random_mac:
                 Macchanger.random()
 
-    @staticmethod
-    def get_wireless_interface():
-        pass
-
     @classmethod
     def load_from_arguments(cls):
         ''' Sets configuration values based on Argument.args object '''
         from .args import Arguments
 
         args = Arguments(cls).args
-        if args.random_mac:
-            cls.random_mac = True
-            Color.pl('{+} {C}option:{W} using {G}random mac address{W} when scanning & attacking')
-        if args.channel:
-            cls.target_channel = args.channel
-            Color.pl('{+} {C}option:{W} scanning for targets on channel {G}%s{W}' % args.channel)
-        if args.interface:
-            cls.interface = args.interface
-            Color.pl('{+} {C}option:{W} using wireless interface {G}%s{W}' % args.interface)
-        if args.target_bssid:
-            cls.target_bssid = args.target_bssid
-            Color.pl('{+} {C}option:{W} targeting BSSID {G}%s{W}' % args.target_bssid)
-        if args.five_ghz == True:
-            cls.five_ghz = True
-            Color.pl('{+} {C}option:{W} including {G}5Ghz networks{W} in scans')
-        if args.show_bssids == True:
-            cls.show_bssids = True
-            Color.pl('{+} {C}option:{W} showing {G}bssids{W} of targets during scan')
-        if args.no_deauth == True:
-            cls.no_deauth = True
-            Color.pl('{+} {C}option:{W} will {R}not{W} {O}deauth{W} clients during scans or captures')
-        if args.num_deauths and args.num_deauths > 0:
-            cls.num_deauths = args.num_deauths
-            Color.pl('{+} {C}option:{W} will send {G}%d{W} deauth packets when deauthing' % cls.num_deauths)
-        if args.target_essid:
-            cls.target_essid = args.target_essid
-            Color.pl('{+} {C}option:{W} targeting ESSID {G}%s{W}' % args.target_essid)
-        if args.ignore_essid is not None:
-            cls.ignore_essid = args.ignore_essid
-            Color.pl('{+} {C}option:{W} {O}ignoring ESSIDs that include {R}%s{W}' % args.ignore_essid)
-        if args.clients_only == True:
-            cls.clients_only = True
-            Color.pl('{+} {C}option:{W} {O}ignoring targets that do not have associated clients')
-        if args.scan_time:
-            cls.scan_time = args.scan_time
-            Color.pl('{+} {C}option:{W} ({G}pillage{W}) attack all targets after {G}%d{W}s' % args.scan_time)
-        if args.verbose:
-            cls.verbose = args.verbose
-            Color.pl('{+} {C}option:{W} verbosity level {G}%d{W}' % args.verbose)
-        if args.kill_conflicting_processes:
-            cls.kill_conflicting_processes = True
-            Color.pl('{+} {C}option:{W} kill conflicting processes {G}enabled{W}')
+        cls.parse_settings_args(args)
+        cls.parse_wep_args(args)
+        cls.parse_wpa_args(args)
+        cls.parse_wps_args(args)
+        cls.parse_encryption()
 
         # EvilTwin
         '''
@@ -187,34 +149,138 @@ class Configuration(object):
             Color.pl('{+} {C}option:{W} using {G}eviltwin attacks{W} against all targets')
         '''
 
-        # WEP
+        cls.parse_wep_attacks()
+
+        cls.validate()
+
+        # Commands
+        if args.cracked:         cls.show_cracked = True
+        if args.check_handshake: cls.check_handshake = args.check_handshake
+        if args.crack_handshake: cls.crack_handshake = True
+
+
+    @classmethod
+    def validate(cls):
+        if cls.use_pmkid_only and cls.wps_only:
+            Color.pl('{!} {R}Bad Configuration:{O} --pmkid and --wps-only are not compatible')
+            raise RuntimeError('Unable to attack networks: --pmkid and --wps-only are not compatible together')
+
+
+    @classmethod
+    def parse_settings_args(cls, args):
+        '''Parses basic settings/configurations from arguments.'''
+        if args.random_mac:
+            cls.random_mac = True
+            Color.pl('{+} {C}option:{W} using {G}random mac address{W} ' +
+                    'when scanning & attacking')
+
+        if args.channel:
+            cls.target_channel = args.channel
+            Color.pl('{+} {C}option:{W} scanning for targets on channel ' +
+                    '{G}%s{W}' % args.channel)
+
+        if args.interface:
+            cls.interface = args.interface
+            Color.pl('{+} {C}option:{W} using wireless interface ' +
+                    '{G}%s{W}' % args.interface)
+
+        if args.target_bssid:
+            cls.target_bssid = args.target_bssid
+            Color.pl('{+} {C}option:{W} targeting BSSID ' +
+                    '{G}%s{W}' % args.target_bssid)
+
+        if args.five_ghz == True:
+            cls.five_ghz = True
+            Color.pl('{+} {C}option:{W} including {G}5Ghz networks{W} in scans')
+
+        if args.show_bssids == True:
+            cls.show_bssids = True
+            Color.pl('{+} {C}option:{W} showing {G}bssids{W} of targets during scan')
+
+        if args.no_deauth == True:
+            cls.no_deauth = True
+            Color.pl('{+} {C}option:{W} will {R}not{W} {O}deauth{W} clients ' +
+                    'during scans or captures')
+
+        if args.num_deauths and args.num_deauths > 0:
+            cls.num_deauths = args.num_deauths
+            Color.pl('{+} {C}option:{W} send {G}%d{W} deauth packets when deauthing' % (
+                cls.num_deauths))
+
+        if args.target_essid:
+            cls.target_essid = args.target_essid
+            Color.pl('{+} {C}option:{W} targeting ESSID {G}%s{W}' % args.target_essid)
+
+        if args.ignore_essid is not None:
+            cls.ignore_essid = args.ignore_essid
+            Color.pl('{+} {C}option:{W} {O}ignoring ESSIDs that include {R}%s{W}' % (
+                args.ignore_essid))
+
+        if args.clients_only == True:
+            cls.clients_only = True
+            Color.pl('{+} {C}option:{W} {O}ignoring targets that do not have ' +
+                'associated clients')
+
+        if args.scan_time:
+            cls.scan_time = args.scan_time
+            Color.pl('{+} {C}option:{W} ({G}pillage{W}) attack all targets ' +
+                'after {G}%d{W}s' % args.scan_time)
+
+        if args.verbose:
+            cls.verbose = args.verbose
+            Color.pl('{+} {C}option:{W} verbosity level {G}%d{W}' % args.verbose)
+
+        if args.kill_conflicting_processes:
+            cls.kill_conflicting_processes = True
+            Color.pl('{+} {C}option:{W} kill conflicting processes {G}enabled{W}')
+
+
+    @classmethod
+    def parse_wep_args(cls, args):
+        '''Parses WEP-specific arguments'''
         if args.wep_filter:
             cls.wep_filter = args.wep_filter
+
         if args.wep_pps:
             cls.wep_pps = args.wep_pps
-            Color.pl('{+} {C}option:{W} using {G}%d{W} packets-per-second on WEP attacks' % args.wep_pps)
+            Color.pl('{+} {C}option:{W} using {G}%d{W} packets/sec on WEP attacks' % (
+                args.wep_pps))
+
         if args.wep_timeout:
             cls.wep_timeout = args.wep_timeout
-            Color.pl('{+} {C}option:{W} WEP attack timeout set to {G}%d seconds{W}' % args.wep_timeout)
+            Color.pl('{+} {C}option:{W} WEP attack timeout set to ' +
+                '{G}%d seconds{W}' % args.wep_timeout)
+
         if args.require_fakeauth:
             cls.require_fakeauth = True
-            Color.pl('{+} {C}option:{W} fake-authentication is {G}required{W} for WEP attacks')
+            Color.pl('{+} {C}option:{W} fake-authentication is ' +
+                '{G}required{W} for WEP attacks')
+
         if args.wep_crack_at_ivs:
             cls.wep_crack_at_ivs = args.wep_crack_at_ivs
-            Color.pl('{+} {C}option:{W} will start cracking WEP keys at {G}%d IVs{W}' % args.wep_crack_at_ivs)
+            Color.pl('{+} {C}option:{W} will start cracking WEP keys at ' +
+                '{G}%d IVs{W}' % args.wep_crack_at_ivs)
+
         if args.wep_restart_stale_ivs:
             cls.wep_restart_stale_ivs = args.wep_restart_stale_ivs
-            Color.pl('{+} {C}option:{W} will restart aireplay after {G}%d seconds{W} of no new IVs' % args.wep_restart_stale_ivs)
+            Color.pl('{+} {C}option:{W} will restart aireplay after ' +
+                '{G}%d seconds{W} of no new IVs' % args.wep_restart_stale_ivs)
+
         if args.wep_restart_aircrack:
             cls.wep_restart_aircrack = args.wep_restart_aircrack
-            Color.pl('{+} {C}option:{W} will restart aircrack every {G}%d seconds{W}' % args.wep_restart_aircrack)
+            Color.pl('{+} {C}option:{W} will restart aircrack every ' +
+                '{G}%d seconds{W}' % args.wep_restart_aircrack)
+
         if args.wep_keep_ivs:
             cls.wep_keep_ivs = args.wep_keep_ivs
             Color.pl('{+} {C}option:{W} keep .ivs files across multiple WEP attacks')
 
-        # WPA
+    @classmethod
+    def parse_wpa_args(cls, args):
+        '''Parses WPA-specific arguments'''
         if args.wpa_filter:
             cls.wpa_filter = args.wpa_filter
+
         if args.wordlist:
             if os.path.exists(args.wordlist):
                 cls.wordlist = args.wordlist
@@ -222,48 +288,105 @@ class Configuration(object):
             else:
                 cls.wordlist = None
                 Color.pl('{+} {C}option:{O} wordlist {R}%s{O} was not found, wifite will NOT attempt to crack handshakes' % args.wordlist)
+
         if args.wpa_deauth_timeout:
             cls.wpa_deauth_timeout = args.wpa_deauth_timeout
-            Color.pl('{+} {C}option:{W} will deauth WPA clients every {G}%d seconds{W}' % args.wpa_deauth_timeout)
+            Color.pl('{+} {C}option:{W} will deauth WPA clients every ' +
+                    '{G}%d seconds{W}' % args.wpa_deauth_timeout)
+
         if args.wpa_attack_timeout:
             cls.wpa_attack_timeout = args.wpa_attack_timeout
-            Color.pl('{+} {C}option:{W} will stop WPA handshake capture after {G}%d seconds{W}' % args.wpa_attack_timeout)
+            Color.pl('{+} {C}option:{W} will stop WPA handshake capture after ' +
+                    '{G}%d seconds{W}' % args.wpa_attack_timeout)
+
         if args.ignore_old_handshakes:
             cls.ignore_old_handshakes = True
-            Color.pl('{+} {C}option:{W} will {O}ignore{W} existing handshakes (force capture)')
+            Color.pl('{+} {C}option:{W} will {O}ignore{W} existing handshakes ' +
+                    '(force capture)')
+
         if args.use_pmkid_only:
             cls.use_pmkid_only = True
             Color.pl('{+} {C}option:{W} will ONLY use {C}PMKID{W} attack on WPA networks')
+
+        if args.pmkid_timeout:
+            cls.pmkid_timeout = args.pmkid_timeout
+            Color.pl('{+} {C}option:{W} will wait {G}%d{W} seconds during {C}PMKID{W} capture')
+
         if args.wpa_handshake_dir:
             cls.wpa_handshake_dir = args.wpa_handshake_dir
-            Color.pl('{+} {C}option:{W} will store handshakes to {G}%s{W}' % args.wpa_handshake_dir)
+            Color.pl('{+} {C}option:{W} will store handshakes to ' +
+                    '{G}%s{W}' % args.wpa_handshake_dir)
+
         if args.wpa_strip_handshake:
             cls.wpa_strip_handshake = True
             Color.pl('{+} {C}option:{W} will {G}strip{W} non-handshake packets')
 
-        # WPS
+    @classmethod
+    def parse_wps_args(cls, args):
+        '''Parses WPS-specific arguments'''
         if args.wps_filter:
             cls.wps_filter = args.wps_filter
+
         if args.wps_only:
             cls.wps_only = True
-            Color.pl('{+} {C}option:{W} will *only* attack non-WEP networks with {G}WPS attacks{W} (no handshake capture)')
+            cls.wps_filter = True  # Also only show WPS networks
+            Color.pl('{+} {C}option:{W} will *only* attack WPS networks with ' +
+                    '{G}WPS attacks{W} (avoids handshake and PMKID)')
+
         if args.no_wps:
+            # No WPS attacks at all
             cls.no_wps = args.no_wps
-            Color.pl('{+} {C}option:{W} will {O}never{W} use {C}WPS attacks{W} (Pixie-Dust/PIN) on targets')
+            cls.wps_pixie = False
+            cls.wps_pin = False
+            Color.pl('{+} {C}option:{W} will {O}never{W} use {C}WPS attacks{W} ' +
+                    '(Pixie-Dust/PIN) on targets')
+
+        elif args.wps_pixie:
+            # WPS Pixie-Dust only
+            cls.wps_pixie = True
+            cls.wps_pin = False
+            Color.pl('{+} {C}option:{W} will {G}only{W} use {C}WPS Pixie-Dust ' +
+                    'attack{W} (no {O}PIN{W}) on targets')
+
+        elif args.wps_no_pixie:
+            # WPS PIN only
+            cls.wps_pixie = False
+            cls.wps_pin = True
+            Color.pl('{+} {C}option:{W} will {G}only{W} use {C}WPS PIN attack{W} ' +
+                    '(no {O}Pixie-Dust{W}) on targets')
+
         if args.use_bully:
-            cls.use_bully = args.use_bully
-            Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} for WPS Attacks')
+            from tools.bully import Bully
+            if not Bully.exists():
+                Color.pl('{!} {R}Bully not found. Defaulting to {O}reaver{W}')
+                cls.use_bully = False
+            else:
+                cls.use_bully = args.use_bully
+                Color.pl('{+} {C}option:{W} use {C}bully{W} instead of {C}reaver{W} ' +
+                        'for WPS Attacks')
+
         if args.wps_pixie_timeout:
             cls.wps_pixie_timeout = args.wps_pixie_timeout
-            Color.pl('{+} {C}option:{W} WPS pixie-dust attack will fail after {O}%d seconds{W}' % args.wps_pixie_timeout)
+            Color.pl('{+} {C}option:{W} WPS pixie-dust attack will fail after ' +
+                    '{O}%d seconds{W}' % args.wps_pixie_timeout)
+
         if args.wps_fail_threshold:
             cls.wps_fail_threshold = args.wps_fail_threshold
-            Color.pl('{+} {C}option:{W} will stop WPS attack after {O}%d failures{W}' % args.wps_fail_threshold)
+            Color.pl('{+} {C}option:{W} will stop WPS attack after ' +
+                    '{O}%d failures{W}' % args.wps_fail_threshold)
+
         if args.wps_timeout_threshold:
             cls.wps_timeout_threshold = args.wps_timeout_threshold
-            Color.pl('{+} {C}option:{W} will stop WPS attack after {O}%d timeouts{W}' % args.wps_timeout_threshold)
+            Color.pl('{+} {C}option:{W} will stop WPS attack after ' +
+                    '{O}%d timeouts{W}' % args.wps_timeout_threshold)
 
-        # Adjust encryption filter
+        if args.wps_ignore_lock:
+            cls.wps_ignore_lock = True
+            Color.pl('{+} {C}option:{W} will {O}ignore{W} WPS lock-outs')
+
+    @classmethod
+    def parse_encryption(cls):
+        '''Adjusts encryption filter (WEP and/or WPA and/or WPS)'''
         cls.encryption_filter = []
         if cls.wep_filter: cls.encryption_filter.append('WEP')
         if cls.wpa_filter: cls.encryption_filter.append('WPA')
@@ -279,7 +402,9 @@ class Configuration(object):
                      'targeting {G}%s-encrypted{W} networks'
                         % '/'.join(cls.encryption_filter))
 
-        # Adjust WEP attack list
+    @classmethod
+    def parse_wep_attacks(cls):
+        '''Parses and sets WEP-specific args (-chopchop, -fragment, etc)'''
         cls.wep_attacks = []
         import sys
         seen = set()
@@ -296,20 +421,16 @@ class Configuration(object):
         if len(cls.wep_attacks) == 0:
             # Use all attacks
             cls.wep_attacks = ['replay',
-                                         'fragment',
-                                         'chopchop',
-                                         'caffelatte',
-                                         'p0841',
-                                         'hirte']
+                'fragment',
+                'chopchop',
+                'caffelatte',
+                'p0841',
+                'hirte'
+            ]
         elif len(cls.wep_attacks) > 0:
             Color.pl('{+} {C}option:{W} using {G}%s{W} WEP attacks'
                 % '{W}, {G}'.join(cls.wep_attacks))
 
-        # Commands
-        if args.cracked: cls.show_cracked = True
-        if args.check_handshake: cls.check_handshake = args.check_handshake
-        if args.crack_handshake: cls.crack_handshake = True
-
 
     @classmethod
     def temp(cls, subfile=''):
@@ -344,8 +465,9 @@ class Configuration(object):
         Macchanger.reset_if_changed()
         from .tools.airmon import Airmon
         if cls.interface is not None and Airmon.base_interface is not None:
-            Color.pl('{!} Leaving interface {C}%s{W} in Monitor Mode.' % cls.interface)
-            Color.pl('{!} You can disable Monitor Mode when finished ({C}airmon-ng stop %s{W})' % cls.interface)
+            Color.pl('{!} {O}Note:{W} Leaving interface in Monitor Mode!')
+            Color.pl('{!} To disable Monitor Mode when finished: ' +
+                    '{C}airmon-ng stop %s{W}' % cls.interface)
 
             # Stop monitor mode
             #Airmon.stop(cls.interface)
@@ -371,7 +493,7 @@ class Configuration(object):
         result += Color.s('{W}%s------------------{W}\n' % ('-' * max_len))
 
         for (key,val) in sorted(cls.__dict__.items()):
-            if key.startswith('__') or type(val) == staticmethod or val is None:
+            if key.startswith('__') or type(val) in [classmethod, staticmethod] or val is None:
                 continue
             result += Color.s('{G}%s {W} {C}%s{W}\n' % (key.ljust(max_len),val))
         return result

wifite/model/target.py

@@ -60,7 +60,8 @@ class Target(object):
             self.essid = None # '(%s)' % self.bssid
             self.essid_known = False
 
-        self.wps = None
+        # False=No WPS, None=Locked WPS, True=Unlocked WPS
+        self.wps = False
 
         self.decloaked = False # If ESSID was hidden but we decloaked it.
 
@@ -136,9 +137,9 @@ class Target(object):
         if self.wps == True:
             wps = Color.s('{G} yes')
         elif self.wps == False:
-            wps = Color.s('{R}  no')
-        else:
-            wps = Color.s('{O} n/a')
+            wps = Color.s('{O}  no')
+        elif self.wps is None:
+            wps = Color.s('{R}lock')
 
         clients = '       '
         if len(self.clients) > 0:

wifite/tools/airmon.py

@@ -204,7 +204,7 @@ class Airmon(Dependency):
         '''Find the interface put into monitor mode (if any)'''
 
         # airmon-ng output: (mac80211 monitor mode vif enabled for [phy10]wlan0 on [phy10]wlan0mon)
-        enabled_re = re.compile(r'\s*\(mac80211 monitor mode (?:vif )?enabled for [^ ]+ on (?:\[\w+\])?(\w+)\)\s*')
+        enabled_re = re.compile(r'.*\(mac80211 monitor mode (?:vif )?enabled (?:for [^ ]+ )?on (?:\[\w+\])?(\w+)\)?.*')
 
         for line in airmon_output.split('\n'):
             matches = enabled_re.match(line)
@@ -277,27 +277,28 @@ class Airmon(Dependency):
 
         Airmon.terminate_conflicting_processes()
 
-        Color.pl('\n{+} looking for {C}wireless interfaces{W}')
+        Color.p('\n{+} Looking for {C}wireless interfaces{W}...')
         monitor_interfaces = Iwconfig.get_interfaces(mode='Monitor')
         if len(monitor_interfaces) == 1:
             # Assume we're using the device already in montior mode
             iface = monitor_interfaces[0]
-            Color.pl('     using interface {G}%s{W} (already in monitor mode)' % iface);
-            Color.pl('     you can specify the wireless interface using {C}-i wlan0{W}')
+            Color.clear_entire_line()
+            Color.pl('{+} Using {G}%s{W} already in monitor mode' % iface);
             Airmon.base_interface = None
             return iface
 
+        Color.clear_entire_line()
+        Color.p('{+} Checking {C}airmon-ng{W}...')
         a = Airmon()
         count = len(a.interfaces)
         if count == 0:
             # No interfaces found
             Color.pl('\n{!} {O}airmon-ng did not find {R}any{O} wireless interfaces')
-            Color.pl('{!} {O}make sure your wireless device is connected')
-            Color.pl('{!} {O}see {C}http://www.aircrack-ng.org/doku.php?id=airmon-ng{O} for more info{W}')
+            Color.pl('{!} {O}Make sure your wireless device is connected')
+            Color.pl('{!} {O}See {C}http://www.aircrack-ng.org/doku.php?id=airmon-ng{O} for more info{W}')
             raise Exception('airmon-ng did not find any wireless interfaces')
 
-        Color.pl('')
-
+        Color.clear_entire_line()
         a.print_menu()
 
         Color.pl('')
@@ -307,7 +308,7 @@ class Airmon(Dependency):
             choice = 1
         else:
             # Multiple interfaces found
-            question = Color.s('{+} select interface ({G}1-%d{W}): ' % (count))
+            question = Color.s('{+} Select wireless interface ({G}1-%d{W}): ' % (count))
             choice = raw_input(question)
 
         iface = a.get(choice)
@@ -347,19 +348,23 @@ class Airmon(Dependency):
                 '{R}%s{O} (PID {R}%s{O})' % (pname, pid)
                 for pid, pname in pid_pnames
             ])
-            Color.pl('{!} {O}conflicting processes: %s' % names_and_pids)
-            Color.pl('{!} {O}if you have problems: {R}kill -9 PID{O} or re-run wifite with {R}--kill{O}){W}')
+            Color.pl('{!} {O}Conflicting processes: %s' % names_and_pids)
+            Color.pl('{!} {O}If you have problems: {R}kill -9 PID{O} or re-run wifite with {R}--kill{O}){W}')
             return
 
-        Color.pl('{!} {O}killing {R}%d {O}conflicting processes' % len(pid_pnames))
+        Color.pl('{!} {O}Killing {R}%d {O}conflicting processes' % len(pid_pnames))
         for pid, pname in pid_pnames:
             if pname == 'NetworkManager' and Process.exists('service'):
                 Color.pl('{!} {O}stopping network-manager ({R}service network-manager stop{O})')
                 # Can't just pkill network manager; it's a service
                 Process(['service', 'network-manager', 'stop']).wait()
                 Airmon.killed_network_manager = True
+            elif pname == 'avahi-daemon' and Process.exists('service'):
+                Color.pl('{!} {O}stopping avahi-daemon ({R}service avahi-daemon stop{O})')
+                # Can't just pkill avahi-daemon; it's a service
+                Process(['service', 'avahi-daemon', 'stop']).wait()
             else:
-                Color.pl('{!} {R}terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
+                Color.pl('{!} {R}Terminating {O}conflicting process {R}%s{O} (PID {R}%s{O})' % (pname, pid))
                 try:
                     os.kill(int(pid), signal.SIGTERM)
                 except:
@@ -407,7 +412,27 @@ class Airmon(Dependency):
             Color.pl(' {R}cannot restart NetworkManager: {O}systemctl{R} or {O}service{R} not found{W}')
 
 if __name__ == '__main__':
-    Airmon.terminate_conflicting_processes()
+    stdout = '''
+Found 2 processes that could cause trouble.
+If airodump-ng, aireplay-ng or airtun-ng stops working after
+a short period of time, you may want to run 'airmon-ng check kill'
+
+  PID Name
+ 5563 avahi-daemon
+ 5564 avahi-daemon
+
+PHY	Interface	Driver		Chipset
+
+phy0	wlx00c0ca4ecae0	rtl8187		Realtek Semiconductor Corp. RTL8187
+Interface 15mon is too long for linux so it will be renamed to the old style (wlan#) name.
+
+		(mac80211 monitor mode vif enabled on [phy0]wlan0mon
+		(mac80211 station mode vif disabled for [phy0]wlx00c0ca4ecae0)
+    '''
+    start_iface = Airmon._parse_airmon_start(stdout)
+    print('start_iface from stdout:', start_iface)
+
+    Configuration.initialize(False)
     iface = Airmon.ask()
     (disabled_iface, enabled_iface) = Airmon.stop(iface)
     print('Disabled:', disabled_iface)

wifite/tools/airodump.py

@@ -260,7 +260,7 @@ class Airodump(Dependency):
                 result.append(target)
             elif 'WPA' in Configuration.encryption_filter and 'WPA' in target.encryption:
                     result.append(target)
-            elif 'WPS' in Configuration.encryption_filter and target.wps:
+            elif 'WPS' in Configuration.encryption_filter and target.wps != False:
                 result.append(target)
             elif skip_wps:
                 result.append(target)

wifite/tools/bully.py

@@ -18,19 +18,25 @@ class Bully(Attack, Dependency):
     dependency_name = 'bully'
     dependency_url = 'https://github.com/aanarchyy/bully'
 
-    def __init__(self, target):
+    def __init__(self, target, pixie_dust=True):
         super(Bully, self).__init__(target)
+
+        self.target = target
+        self.pixie_dust = pixie_dust
+
+        self.total_attempts = 0
         self.total_timeouts = 0
         self.total_failures = 0
         self.locked = False
         self.state = '{O}Waiting for beacon{W}'
         self.start_time = time.time()
+        self.last_pin = ""
+        self.pins_remaining = -1
+        self.eta = ''
 
         self.cracked_pin = self.cracked_key = self.cracked_bssid = self.cracked_essid = None
         self.crack_result = None
 
-        self.target = target
-
         self.cmd = []
 
         if Process.exists('stdbuf'):
@@ -42,13 +48,20 @@ class Bully(Attack, Dependency):
             'bully',
             '--bssid', target.bssid,
             '--channel', target.channel,
-            '--detectlock', # Detect WPS lockouts unreported by AP
+            #'--detectlock', # Detect WPS lockouts unreported by AP
+
+            # Restoring session from '/root/.bully/34210901927c.run'
+            # WARNING: WPS checksum was bruteforced in prior session, now autogenerated
+            # Use --force to ignore above warning(s) and continue anyway
             '--force',
+
             '-v', '4',
-            '--pixiewps',
             Configuration.interface
         ])
 
+        if self.pixie_dust:
+            self.cmd.insert(-1, '--pixiewps')
+
         self.bully_proc = None
 
 
@@ -73,36 +86,7 @@ class Bully(Attack, Dependency):
             t.start()
 
             try:
-                while self.bully_proc.poll() is None:
-                    try:
-                        self.target = self.wait_for_target(airodump)
-                    except Exception as e:
-                        self.pattack('{R}Failed: {O}%s{W}' % e, newline=True)
-                        self.stop()
-                        break
-
-                    # Update status
-                    self.pattack(self.get_status())
-
-                    # Check if entire attack timed out.
-                    if self.running_time() > Configuration.wps_pixie_timeout:
-                        self.pattack('{R}Failed: {O}Timeout after %d seconds{W}' % Configuration.wps_pixie_timeout, newline=True)
-                        self.stop()
-                        return
-
-                    # Check if timeout threshold was breached
-                    if self.total_timeouts >= Configuration.wps_timeout_threshold:
-                        self.pattack('{R}Failed: {O}More than %d timeouts{W}' % Configuration.wps_timeout_threshold, newline=True)
-                        self.stop()
-                        return
-
-                    # Check if WPSFail threshold was breached
-                    if self.total_failures >= Configuration.wps_fail_threshold:
-                        self.pattack('{R}Failed: {O}More than %d WPSFails{W}' % Configuration.wps_fail_threshold, newline=True)
-                        self.stop()
-                        return
-
-                    time.sleep(0.5)
+                self._run(airodump)
             except KeyboardInterrupt as e:
                 self.stop()
                 raise e
@@ -113,16 +97,76 @@ class Bully(Attack, Dependency):
         if self.crack_result is None:
             self.pattack('{R}Failed{W}', newline=True)
 
+    def _run(self, airodump):
+        while self.bully_proc.poll() is None:
+            try:
+                self.target = self.wait_for_target(airodump)
+            except Exception as e:
+                self.pattack('{R}Failed: {O}%s{W}' % e, newline=True)
+                Color.pexception(e)
+                self.stop()
+                break
+
+            # Update status
+            self.pattack(self.get_status())
+
+            # Thresholds only apply to Pixie-Dust
+            if self.pixie_dust:
+                # Check if entire attack timed out.
+                if self.running_time() > Configuration.wps_pixie_timeout:
+                    self.pattack('{R}Failed: {O}Timeout after %d seconds{W}' % (
+                        Configuration.wps_pixie_timeout), newline=True)
+                    self.stop()
+                    return
+
+                # Check if timeout threshold was breached
+                if self.total_timeouts >= Configuration.wps_timeout_threshold:
+                    self.pattack('{R}Failed: {O}More than %d Timeouts{W}' % (
+                        Configuration.wps_timeout_threshold), newline=True)
+                    self.stop()
+                    return
+
+                # Check if WPSFail threshold was breached
+                if self.total_failures >= Configuration.wps_fail_threshold:
+                    self.pattack('{R}Failed: {O}More than %d WPSFails{W}' % (
+                        Configuration.wps_fail_threshold), newline=True)
+                    self.stop()
+                    return
+            else:
+                if self.locked and not Configuration.wps_ignore_lock:
+                    self.pattack('{R}Failed: {O}AP became {R}Locked{O}', newline=True)
+                    self.stop()
+                    return
+
+
+            time.sleep(0.5)
+
 
     def pattack(self, message, newline=False):
         # Print message with attack information.
-        time_left = Configuration.wps_pixie_timeout - self.running_time()
+        if self.pixie_dust:
+            # Count down
+            time_left = Configuration.wps_pixie_timeout - self.running_time()
+            attack_name = 'Pixie-Dust'
+        else:
+            # Count up
+            time_left = self.running_time()
+            attack_name = 'PIN Attack'
+
+        if self.eta:
+            time_msg = '{D}ETA:{W}{C}%s{W}' % self.eta
+        else:
+            time_msg = '{C}%s{W}' % Timer.secs_to_str(time_left)
+
+        if self.pins_remaining >= 0:
+            time_msg += ', {D}PINs Left:{W}{C}%d{W}' % self.pins_remaining
+        else:
+            time_msg += ', {D}PINs:{W}{C}%d{W}' % self.total_attempts
 
         Color.clear_entire_line()
-        Color.pattack('WPS',
-                self.target,
-                'Pixie-Dust',
-                '{W}[{C}%s{W}] %s' % (Timer.secs_to_str(time_left), message))
+        Color.pattack('WPS', self.target, attack_name,
+                '{W}[%s] %s' % (time_msg, message))
+
         if newline:
             Color.pl('')
 
@@ -139,7 +183,7 @@ class Bully(Attack, Dependency):
             meta_statuses.append('{O}Timeouts:%d{W}' % self.total_timeouts)
 
         if self.total_failures > 0:
-            meta_statuses.append('{O}WPSFail:%d{W}' % self.total_failures)
+            meta_statuses.append('{O}Fails:%d{W}' % self.total_failures)
 
         if self.locked:
             meta_statuses.append('{R}Locked{W}')
@@ -153,6 +197,7 @@ class Bully(Attack, Dependency):
     def parse_line_thread(self):
         for line in iter(self.bully_proc.pid.stdout.readline, b''):
             if line == '': continue
+            line = line.decode('utf-8')
             line = line.replace('\r', '').replace('\n', '').strip()
 
             if Configuration.verbose > 1:
@@ -191,7 +236,7 @@ class Bully(Attack, Dependency):
                 # Mention the PIN & that we're not done yet.
                 self.pattack('{G}Cracked PIN: {C}%s{W}' % self.cracked_pin, newline=True)
 
-                self.state = '{G}Finding PSK...{C}'
+                self.state = '{G}Finding Key...{C}'
                 time.sleep(2)
 
         ###########################
@@ -201,7 +246,7 @@ class Bully(Attack, Dependency):
             self.cracked_key = key_re.group(1)
 
         if not self.crack_result and self.cracked_pin and self.cracked_key:
-            self.pattack('{G}Cracked PSK: {C}%s{W}' % self.cracked_key, newline=True)
+            self.pattack('{G}Cracked Key: {C}%s{W}' % self.cracked_key, newline=True)
             self.crack_result = CrackResultWPS(
                     self.target.bssid,
                     self.target.essid,
@@ -225,20 +270,33 @@ class Bully(Attack, Dependency):
         # [+] Last State = 'NoAssoc'   Next pin '48855501'
         last_state = re.search(r".*Last State = '(.*)'\s*Next pin '(.*)'", line)
         if last_state:
-            # group(1)=result, group(2)=PIN
+            # group(1)=NoAssoc, group(2)=PIN
             pin = last_state.group(2)
-            state = 'Trying PIN {C}%s{W} (%s)' % (pin, last_state.group(1))
+            if pin != self.last_pin:
+                self.last_pin = pin
+                self.total_attempts += 1
+                if self.pins_remaining > 0:
+                    self.pins_remaining -= 1
+            state = 'Trying PIN'
 
         # [+] Tx( Auth ) = 'Timeout'   Next pin '80241263'
-        mx_result_pin = re.search(r".*[RT]x\(\s*(.*)\s*\) = '(.*)'\s*Next pin '(.*)'", line)
+        mx_result_pin = re.search(
+                r".*[RT]x\(\s*(.*)\s*\) = '(.*)'\s*Next pin '(.*)'", line)
         if mx_result_pin:
+            # group(1)=M1,M2,..,M7, group(2)=result, group(3)=Next PIN
             self.locked = False
-            # group(1)=M3/M5, group(2)=result, group(3)=PIN
             m_state = mx_result_pin.group(1)
-            result = mx_result_pin.group(2) # NoAssoc, WPSFail, Pin1Bad, Pin2Bad
+            result = mx_result_pin.group(2)  # NoAssoc, WPSFail, Pin1Bad, Pin2Bad
             pin = mx_result_pin.group(3)
+            if pin != self.last_pin:
+                self.last_pin = pin
+                self.total_attempts += 1
+                if self.pins_remaining > 0:
+                    self.pins_remaining -= 1
 
-            if result == 'Timeout':
+            if result in ['Pin1Bad', 'Pin2Bad']:
+                result = '{G}%s{W}' % result
+            elif result == 'Timeout':
                 self.total_timeouts += 1
                 result = '{O}%s{W}' % result
             elif result == 'WPSFail':
@@ -250,14 +308,33 @@ class Bully(Attack, Dependency):
                 result = '{R}%s{W}' % result
 
             result = '{P}%s{W}:%s' % (m_state.strip(), result.strip())
-            state = 'Trying PIN {C}%s{W} (%s)' % (pin, result)
+            state = 'Trying PIN (%s)' % result
+
+        # [!] Run time 00:02:49, pins tested 32 (5.28 seconds per pin)
+        re_tested = re.search(r'Run time ([0-9:]+), pins tested ([0-9])+', line)
+        if re_tested:
+            # group(1)=01:23:45, group(2)=1234
+            self.total_attempts = int(re_tested.group(2))
+
+        #[!] Current rate 5.28 seconds per pin, 07362 pins remaining
+        re_remaining = re.search(r' ([0-9]+) pins remaining', line)
+        if re_remaining:
+            self.pins_remaining = int(re_remaining.group(1))
+
+        # [!] Average time to crack is 5 hours, 23 minutes, 55 seconds
+        re_eta = re.search(
+                r'time to crack is (\d+) hours, (\d+) minutes, (\d+) seconds', line)
+        if re_eta:
+            h, m, s = re_eta.groups()
+            self.eta = '%sh%sm%ss' % (
+                    h.rjust(2, '0'), m.rjust(2, '0'), s.rjust(2, '0'))
 
         # [!] WPS lockout reported, sleeping for 43 seconds ...
         re_lockout = re.search(r".*WPS lockout reported, sleeping for (\d+) seconds", line)
         if re_lockout:
             self.locked = True
             sleeping = re_lockout.group(1)
-            state = '{R}WPS Lock-out: {O}Waiting %s seconds{W}' % sleeping
+            state = '{R}WPS Lock-out: {O}Waiting %s seconds...{W}' % sleeping
 
         # [Pixie-Dust] WPS pin not found
         re_pin_not_found = re.search(r".*\[Pixie-Dust\] WPS pin not found", line)

wifite/tools/dependency.py

@@ -14,6 +14,12 @@ class Dependency(object):
                 )
 
 
+    @classmethod
+    def exists(cls):
+        from ..util.process import Process
+        return Process.exists(cls.dependency_name)
+
+
     @classmethod
     def run_dependency_check(cls):
         from ..util.color import Color

wifite/tools/hashcat.py

@@ -28,7 +28,7 @@ class Hashcat(Dependency):
 
         key = None
         # Crack hccapx
-        for additional_arg in [ [], ['--show']]:
+        for additional_arg in ([], ['--show']):
             command = [
                 'hashcat',
                 '--quiet',
@@ -65,7 +65,7 @@ class Hashcat(Dependency):
 
         # Run hashcat once normally, then with --show if it failed
         # To catch cases where the password is already in the pot file.
-        for additional_arg in [ [], ['--show']]:
+        for additional_arg in ([], ['--show']):
             command = [
                 'hashcat',
                 '--quiet',      # Only output the password if found.

wifite/tools/iwconfig.py

@@ -8,11 +8,6 @@ class Iwconfig(Dependency):
     dependency_name = 'iwconfig'
     dependency_url = 'apt-get install wireless-tools'
 
-    @classmethod
-    def exists(cls):
-        from ..util.process import Process
-        return Process.exists('iwconfig')
-
 
     @classmethod
     def mode(cls, iface, mode_name):

wifite/tools/pyrit.py

@@ -14,9 +14,6 @@ class Pyrit(Dependency):
     def __init__(self):
         pass
 
-    @staticmethod
-    def exists():
-        return Process.exists('pyrit')
 
     @staticmethod
     def bssid_essid_with_handshakes(capfile, bssid=None, essid=None):

wifite/tools/reaver.py

@@ -6,10 +6,10 @@ from .airodump import Airodump
 from .bully import Bully # for PSK retrieval
 from ..model.attack import Attack
 from ..config import Configuration
+from ..model.wps_result import CrackResultWPS
 from ..util.color import Color
 from ..util.process import Process
 from ..util.timer import Timer
-from ..model.wps_result import CrackResultWPS
 
 import os, time, re
 
@@ -18,14 +18,19 @@ class Reaver(Attack, Dependency):
     dependency_name = 'reaver'
     dependency_url = 'https://github.com/t6x/reaver-wps-fork-t6x'
 
-    def __init__(self, target):
+    def __init__(self, target, pixie_dust=True):
         super(Reaver, self).__init__(target)
 
-        self.start_time = None
+        self.pixie_dust = pixie_dust
+
+        self.progress = '0.00%'
         self.state = 'Initializing'
         self.locked = False
+        self.total_attempts = 0
         self.total_timeouts = 0
         self.total_wpsfails = 0
+        self.last_pins = set()
+        self.last_line_number = 0
 
         self.crack_result = None
 
@@ -40,14 +45,16 @@ class Reaver(Attack, Dependency):
             '--interface',  Configuration.interface,
             '--bssid',      self.target.bssid,
             '--channel',    self.target.channel,
-            '--pixie-dust', '1',         # pixie-dust attack
-            '--session',    '/dev/null', # Don't restart session
-            '-vv'                        # (very) verbose
+            '-vv'
         ]
 
+        if pixie_dust:
+            self.reaver_cmd.extend(['--pixie-dust', '1'])
+
         self.reaver_proc = None
 
-    def is_pixiedust_supported(self):
+    @staticmethod
+    def is_pixiedust_supported():
         ''' Checks if 'reaver' supports WPS Pixie-Dust attack '''
         output = Process(['reaver', '-h']).stderr()
         return '--pixie-dust' in output
@@ -88,6 +95,8 @@ class Reaver(Attack, Dependency):
             self.reaver_proc = Process(self.reaver_cmd,
                     stdout=self.output_write,
                     stderr=Process.devnull())
+            # Say "yes" if asked to restore session.
+            self.reaver_proc.stdin('y\n')
 
             # Loop while reaver is running
             while self.crack_result is None and self.reaver_proc.poll() is None:
@@ -106,6 +115,10 @@ class Reaver(Attack, Dependency):
                 # Check if we cracked it
                 self.crack_result = self.parse_crack_result(stdout)
 
+                # Check if locked
+                if self.locked and not Configuration.wps_ignore_lock:
+                    raise Exception('{O}Because access point is {R}Locked{W}')
+
                 time.sleep(0.5)
 
             # Check if crack result is in output
@@ -121,14 +134,23 @@ class Reaver(Attack, Dependency):
 
 
     def get_status(self):
-        main_status = self.state
+        if self.pixie_dust:
+            main_status = ''
+        else:
+            # Include percentage
+            main_status = '({G}%s{W}) ' % self.progress
 
+        # Current state (set in parse_* methods)
+        main_status += self.state
+
+        # Counters, timeouts, failures, locked.
         meta_statuses = []
+
         if self.total_timeouts > 0:
             meta_statuses.append('{O}Timeouts:%d{W}' % self.total_timeouts)
 
         if self.total_wpsfails > 0:
-            meta_statuses.append('{O}WPSFail:%d{W}' % self.total_wpsfails)
+            meta_statuses.append('{O}Fails:%d{W}' % self.total_wpsfails)
 
         if self.locked:
             meta_statuses.append('{R}Locked{W}')
@@ -181,7 +203,7 @@ class Reaver(Attack, Dependency):
             raise Exception('Reaver says "WPS pin not found"')
 
         # Running-time failure
-        if self.running_time() > Configuration.wps_pixie_timeout:
+        if self.pixie_dust and self.running_time() > Configuration.wps_pixie_timeout:
             raise Exception('Timeout after %d seconds' % Configuration.wps_pixie_timeout)
 
         # WPSFail count
@@ -198,47 +220,94 @@ class Reaver(Attack, Dependency):
     def parse_state(self, stdout):
         state = self.state
 
+        # Check last line for current status
         stdout_last_line = stdout.split('\n')[-1]
 
+        # [+] Waiting for beacon from AA:BB:CC:DD:EE:FF
         if 'Waiting for beacon from' in stdout_last_line:
             state = 'Waiting for beacon'
 
+        # [+] Associated with AA:BB:CC:DD:EE:FF (ESSID: NETGEAR07)
         elif 'Associated with' in stdout_last_line:
             state = 'Associated'
 
         elif 'Starting Cracking Session.' in stdout_last_line:
-            state = 'Waiting to try PIN'
+            state = 'Started Cracking'
 
+        # [+] Trying pin "01235678"
         elif 'Trying pin' in stdout_last_line:
             state = 'Trying PIN'
 
+        # [+] Sending EAPOL START request
         elif 'Sending EAPOL START request' in stdout_last_line:
-            state = 'Sending EAPOL Start request'
+            state = 'Sending EAPOL'
 
+        # [+] Sending identity response
         elif 'Sending identity response' in stdout_last_line:
-            state = 'Sending identity response'
+            state = 'Sending ID'
             self.locked = False
 
-        elif 'Sending M2 message' in stdout_last_line:
-            state = 'Sending M2 / Running pixiewps'
-            self.locked = False
+        # [+] Sending M2 message
+        elif 'Sending M' in stdout_last_line:
+            for num in ['2', '4', '6']:
+                if 'Sending M%s message' % num in stdout_last_line:
+                    state = 'Sending M%s' % num
+                    if num == '2' and self.pixie_dust:
+                        state += ' / Running pixiewps'
+                    self.locked = False
 
+        # [+] Received M1 message
+        elif 'Received M' in stdout_last_line:
+            for num in ['1', '3', '5', '7']:
+                if 'Received M%s message' % num in stdout_last_line:
+                    state = 'Received M%s' % num
+                    self.locked = False
+
+        # [!] WARNING: Detected AP rate limiting, waiting 60 seconds before re-checking
         elif 'Detected AP rate limiting,' in stdout_last_line:
             state = 'Rate-Limited by AP'
             self.locked = True
 
+        # Parse all lines since last check
+        stdout_diff = stdout[self.last_line_number:]
+        self.last_line_number = len(stdout)
+
+        # Detect percentage complete
+        # [+] 0.05% complete @ 2018-08-23 15:17:23 (42 seconds/pin)
+        percentages = re.findall(
+                r"([0-9.]+%) complete .* \(([0-9.]+) seconds/pin\)", stdout_diff)
+        if len(percentages) > 0:
+            self.progress = percentages[-1][0]
+
+        # Calculate number of PINs tried
+        # [+] Trying pin "01235678"
+        new_pins = set(re.findall(r'Trying pin "([0-9]+)"', stdout_diff))
+        if len(new_pins) > 0:
+            self.total_attempts += len(new_pins.difference(self.last_pins))
+            self.last_pins = new_pins
+
+        # TODO: Look for "Sending M6 message" which indicates first 4 digits are correct.
+
         return state
 
 
     def pattack(self, message, newline=False):
         # Print message with attack information.
-        time_left = Configuration.wps_pixie_timeout - self.running_time()
+        if self.pixie_dust:
+            time_left = Configuration.wps_pixie_timeout - self.running_time()
+            time_msg = '{O}%s{W}' % Timer.secs_to_str(time_left)
+            attack_name = 'Pixie-Dust'
+        else:
+            time_left = self.running_time()
+            time_msg = '{C}%s{W}' % Timer.secs_to_str(time_left)
+            attack_name = 'PIN Attack'
+
+        if self.total_attempts > 0 and not self.pixie_dust:
+            time_msg += ' {D}PINs:{W}{C}%d{W}' % self.total_attempts
 
         Color.clear_entire_line()
-        Color.pattack('WPS',
-                self.target,
-                'Pixie-Dust',
-                '{W}[{C}%s{W}] %s' % (Timer.secs_to_str(time_left), message))
+        Color.pattack('WPS', self.target, attack_name,
+                '{W}[%s] %s' % (time_msg, message))
         if newline:
             Color.pl('')
 
@@ -253,14 +322,21 @@ class Reaver(Attack, Dependency):
         pin = psk = ssid = None
 
         # Check for PIN.
-        '''  [+] WPS pin:  11867722'''
-        regex = re.search(r"WPS pin:\s*([0-9]*)", stdout, re.IGNORECASE)
+        ''' [+] WPS pin:  11867722 '''
+        regex = re.search(r"WPS pin:\s*([0-9]+)", stdout, re.IGNORECASE)
         if regex:
             pin = regex.group(1)
 
+        if pin is None:
+            ''' [+] WPS PIN: '11867722' '''
+            regex = re.search(r"WPS PIN:\s*'([0-9]+)'", stdout, re.IGNORECASE)
+            if regex:
+                pin = regex.group(1)
+
         # Check for PSK.
         # Note: Reaver 1.6.x does not appear to return PSK (?)
-        regex = re.search(r"WPA PSK: *'(.+)'", stdout)
+        ''' [+] WPA PSK: 'password' '''
+        regex = re.search(r"WPA PSK:\s*'(.+)'", stdout)
         if regex:
             psk = regex.group(1)
 
@@ -350,18 +426,33 @@ Cmd : reaver -i wlan0mon -b 08:86:3B:8C:FD:9C -c 11 -s y -vv -p 28097402
 
 executing pixiewps -e d0141b15656e96b85fcead2e8e76330d2b1ac1576bb026e7a328c0e1baf8cf91664371174c08ee12ec92b0519c54879f21255be5a8770e1fa1880470ef423c90e34d7847a6fcb4924563d1af1db0c481ead9852c519bf1dd429c163951cf69181b132aea2a3684caf35bc54aca1b20c88bb3b7339ff7d56e09139d77f0ac58079097938251dbbe75e86715cc6b7c0ca945fa8dd8d661beb73b414032798dadee32b5dd61bf105f18d89217760b75c5d966a5a490472ceba9e3b4224f3d89fb2b -s 5a67001334e3e4cb236f4e134a4d3b48d625a648e991f978d9aca879469d5da5 -z c8a2ccc5fb6dc4f4d69b245091022dc7e998e42ec1d548d57c35a312ff63ef20 -a 60b59c0c587c6c44007f7081c3372489febbe810a97483f5cc5cd8463c3920de -n 04d48dc20ec785762ce1a21a50bc46c2 -r 7a191e22a7b519f40d3af21b93a21d4f837718b45063a8a69ac6d16c6e5203477c18036ca01e9e56d0322e70c2e1baa66518f1b46d01acc577d1dfa34efd2e9ee36e2b7e68819cddacceb596a8895243e33cb48c570458a539dcb523a4d4c4360e158c29b882f7f385821ea043705eb56538b45daa445157c84e60fc94ef48136eb4e9725b134902b96c90b1ae54cbd42b29b52611903fdae5aa88bfc320f173d2bbe31df4996ebdb51342c6b8bd4e82ae5aa80b2a09a8bf8faa9a8332dc9819
 '''
+    pin_attack_stdout = '''
+[+] Pin cracked in 16 seconds
+[+] WPS PIN: '01030365'
+[+] WPA PSK: 'password'
+[+] AP SSID: 'AirLink89300'
+'''
+
     (pin, psk, ssid) = Reaver.get_pin_psk_ssid(old_stdout)
     assert pin  == '12345678',    'pin was "%s", should have been "12345678"' % pin
     assert psk  == 'Test PSK',    'psk was "%s", should have been "Test PSK"' % psk
     assert ssid == 'Test Router', 'ssid was %s, should have been Test Router' % repr(ssid)
     result = CrackResultWPS('AA:BB:CC:DD:EE:FF', ssid, pin, psk)
     result.dump()
-
     print('')
 
     (pin, psk, ssid) = Reaver.get_pin_psk_ssid(new_stdout)
     assert pin  == '11867722',   'pin was "%s", should have been "11867722"' % pin
-    assert psk  == None,         'psk was "%s", should have been "None"' % psk
+    assert psk  is None,         'psk was "%s", should have been "None"' % psk
     assert ssid == 'belkin.00e', 'ssid was "%s", should have been "belkin.00e"' % repr(ssid)
     result = CrackResultWPS('AA:BB:CC:DD:EE:FF', ssid, pin, psk)
     result.dump()
+    print('')
+
+    (pin, psk, ssid) = Reaver.get_pin_psk_ssid(pin_attack_stdout)
+    assert pin  == '01030365',   'pin was "%s", should have been "01030365"' % pin
+    assert psk  == 'password',   'psk was "%s", should have been "password"' % psk
+    assert ssid == 'AirLink89300', 'ssid was "%s", should have been "AirLink89300"' % repr(ssid)
+    result = CrackResultWPS('AA:BB:CC:DD:EE:FF', ssid, pin, psk)
+    result.dump()
+    print('')

wifite/tools/tshark.py

@@ -14,9 +14,6 @@ class Tshark(Dependency):
     def __init__(self):
         pass
 
-    @staticmethod
-    def exists():
-        return Process.exists('tshark')
 
     @staticmethod
     def _extract_src_dst_index_total(line):
@@ -29,6 +26,7 @@ class Tshark(Dependency):
         (src, dst, index, total) = match.groups()
         return src, dst, index, total
 
+
     @staticmethod
     def _build_target_client_handshake_map(output, bssid=None):
         # Map of target_ssid,client_ssid -> handshake #s
@@ -159,6 +157,7 @@ class Tshark(Dependency):
                 capfile - .cap file from airodump containing packets
                 targets - list of Targets from scan, to be updated
         '''
+        from ..config import Configuration
 
         if not Tshark.exists():
             raise ValueError('Cannot detect WPS networks: Tshark does not exist')
@@ -183,24 +182,32 @@ class Tshark(Dependency):
             # Failure is acceptable
             return
 
-        bssids = set()
+        wps_bssids = set()
+        locked_bssids = set()
         for line in lines.split('\n'):
             if ',' not in line:
                 continue
             bssid, locked = line.split(',')
             # Ignore if WPS is locked?
             if '1' not in locked:
-                bssids.add(bssid.upper())
+                wps_bssids.add(bssid.upper())
+            else:
+                locked_bssids.add(bssid.upper())
 
         for t in targets:
-            t.wps = t.bssid.upper() in bssids
+            target_bssid = t.bssid.upper()
+            if target_bssid in wps_bssids:
+                t.wps = True
+            elif target_bssid in locked_bssids:
+                t.wps = None
+            else:
+                t.wps = False
 
 
 if __name__ == '__main__':
     test_file = './tests/files/contains_wps_network.cap'
 
     target_bssid = 'A4:2B:8C:16:6B:3A'
-    '''
     from ..model.target import Target
     fields = [
         'A4:2B:8C:16:6B:3A', # BSSID
@@ -219,6 +226,5 @@ if __name__ == '__main__':
 
     print('Target(BSSID={}).wps = {} (Expected: True)'.format(targets[0].bssid, targets[0].wps))
     assert targets[0].wps == True
-    '''
 
     print(Tshark.bssids_with_handshakes(test_file, bssid=target_bssid))

wifite/tools/wash.py

@@ -14,9 +14,6 @@ class Wash(Dependency):
     def __init__(self):
         pass
 
-    @staticmethod
-    def exists():
-        return Process.exists('wash')
 
     @staticmethod
     def check_for_wps_and_update_targets(capfile, targets):
@@ -36,22 +33,32 @@ class Wash(Dependency):
         except:
             # Failure is acceptable
             return
-        
+
         # Find all BSSIDs
-        bssids = set()
+        wps_bssids = set()
+        locked_bssids = set()
         for line in lines.split('\n'):
             try:
                 obj = json.loads(line)
                 bssid = obj['bssid']
                 locked = obj['wps_locked']
                 if locked != True:
-                    bssids.add(bssid)
+                    wps_bssids.add(bssid)
+                else:
+                    locked_bssids.add(bssid)
             except:
                 pass
 
         # Update targets
         for t in targets:
-            t.wps = t.bssid.upper() in bssids
+            target_bssid = t.bssid.upper()
+            if target_bssid in wps_bssids:
+                t.wps = True
+            elif target_bssid in locked_bssids:
+                t.wps = None
+            else:
+                t.wps = False
+
 
 if __name__ == '__main__':
     test_file = './tests/files/contains_wps_network.cap'

wifite/util/process.py

@@ -63,7 +63,7 @@ class Process(object):
 
         return True
 
-    def __init__(self, command, devnull=False, stdout=PIPE, stderr=PIPE, cwd=None, bufsize=0):
+    def __init__(self, command, devnull=False, stdout=PIPE, stderr=PIPE, cwd=None, bufsize=0, stdin=PIPE):
         ''' Starts executing command '''
 
         if type(command) is str:
@@ -86,7 +86,7 @@ class Process(object):
 
         self.start_time = time.time()
 
-        self.pid = Popen(command, stdout=sout, stderr=serr, cwd=cwd, bufsize=bufsize)
+        self.pid = Popen(command, stdout=sout, stderr=serr, stdin=stdin, cwd=cwd, bufsize=bufsize)
 
     def __del__(self):
         '''
@@ -119,6 +119,11 @@ class Process(object):
     def stderrln(self):
         return self.pid.stderr.readline()
 
+    def stdin(self, text):
+        if self.pid.stdin:
+            self.pid.stdin.write(text.encode('utf-8'))
+            self.pid.stdin.flush()
+
     def get_output(self):
         ''' Waits for process to finish, sets stdout & stderr '''
         if self.pid.poll() is None:

wifite/util/scanner.py

@@ -54,7 +54,7 @@ class Scanner(object):
                     self.print_targets()
 
                     target_count = len(self.targets)
-                    client_count = sum([len(t.clients) for t in self.targets])
+                    client_count = sum(len(t.clients) for t in self.targets)
 
                     outline = '\r{+} Scanning'
                     if airodump.decloaking:
@@ -88,7 +88,7 @@ class Scanner(object):
             return False  # No specific target from user.
 
         for target in self.targets:
-            if Configuration.wps_only and target.wps != True:
+            if Configuration.wps_only and target.wps == False:
                 continue
             if bssid and target.bssid and bssid.lower() == target.bssid.lower():
                 self.target = target
@@ -131,7 +131,7 @@ class Scanner(object):
         self.previous_target_count = len(self.targets)
 
         # Overwrite the current line
-        Color.p('\r')
+        Color.p('\r{W}{D}')
 
         # First row: columns
         Color.p('   NUM')
@@ -145,7 +145,7 @@ class Scanner(object):
         Color.p('  -------------------------')
         if Configuration.show_bssids:
             Color.p('  -----------------')
-        Color.pl('  ---  ----  -----  ----  ------')
+        Color.pl('  ---  ----  -----  ----  ------{W}')
 
         # Remaining rows: targets
         for idx, target in enumerate(self.targets, start=1):

wifite/util/timer.py

@@ -28,8 +28,8 @@ class Timer(object):
             return '-%ds' % seconds
 
         rem = int(seconds)
-        hours = rem / 3600
-        mins = (rem % 3600) / 60
+        hours = int(rem / 3600)
+        mins = int((rem % 3600) / 60)
         secs = rem % 60
         if hours > 0:
             return '%dh%dm%ds' % (hours, mins, secs)