Documentation
¶
Overview ¶
Package wps decodes the Wi-Fi Simple Configuration (WPS) data elements carried in the WPS vendor-specific Information Element of 802.11 beacons and probe responses (Microsoft OUI 00:50:F2, vendor type 0x04).
Wrap-vs-native judgement ¶
Native. The WSC attribute format is a public, fully-deterministic TLV — a 2-byte big-endian attribute type, a 2-byte big-endian length, then the value — documented in the Wi-Fi Simple Configuration Technical Specification and implemented identically by hostapd, wpa_supplicant, reaver, bully and wash. Decoding is a short walker over a byte slice with a static attribute-ID table; no crypto, no hardware, no SDR. The existing internal/ieee80211 vendor-IE decoder already identifies the WPS IE but leaves its body as opaque hex — this turns that body into the recon fields an operator needs to triage WPS attack surface: the protocol version, whether the AP is setup-locked (reaver/bully are useless against a locked AP), the active Device Password ID and config methods (PIN vs push-button), and the device identity strings.
No confidently-wrong output ¶
Only attribute IDs and enumerated values documented in the WSC spec are named; any unknown attribute type or out-of-range enum value is surfaced with its raw hex and numeric type rather than guessed. A truncated TLV stops the walk with the attributes parsed so far plus a note.
Deliberately deferred ¶
The WSC Vendor Extension subelements (attribute 0x1049 — Version2 etc.) are surfaced as raw hex rather than recursed into, and the cryptographic registration-protocol attributes (Enrollee/Registrar nonces, public keys, E-Hash/E-SNonce) are not interpreted — they appear only in the EAP-WSC exchange, not the beacon/probe IE this package targets, and carry no recon value decoded.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Checksum ¶ added in v0.400.0
Checksum computes the WPS PIN check digit for a 7-digit prefix, per the Wi-Fi Simple Configuration PIN-checksum algorithm (the same routine reaver / bully use). The 8-digit device PIN is the 7-digit prefix followed by this digit, so a brute-force only needs to search the 10^7 prefixes — the checksum makes the 8th digit free.
accum over digits: 3*(units) + tens, repeated; digit = (10 - accum%10) % 10
Types ¶
type Attribute ¶
type Attribute struct {
Type int `json:"type"` // 16-bit attribute ID
TypeHex string `json:"type_hex"` // "0x104A"
Name string `json:"name"` // canonical name, or "Unknown"
Length int `json:"length"` // value length in bytes
ValueHex string `json:"value_hex"` // raw value as hex
Decoded any `json:"decoded,omitempty"` // interpreted value for known attributes
}
Attribute is one decoded WSC data element.
type PINResult ¶ added in v0.400.0
type PINResult struct {
Input string `json:"input"`
Digits int `json:"digits"`
Mode string `json:"mode"` // "validate" | "complete"
Valid *bool `json:"valid,omitempty"`
ExpectedDigit *int `json:"expected_check_digit,omitempty"`
FullPIN string `json:"full_pin,omitempty"`
WellKnown string `json:"well_known,omitempty"`
Note string `json:"note,omitempty"`
}
PINResult is the decoded view of a WPS PIN check.
type WSC ¶
type WSC struct {
Attributes []Attribute `json:"attributes"`
Count int `json:"count"`
// Summary lifts the recon-relevant fields to the top level so an
// operator can triage at a glance.
Version string `json:"version,omitempty"`
SetupState string `json:"setup_state,omitempty"`
APSetupLocked *bool `json:"ap_setup_locked,omitempty"`
DevicePasswordID string `json:"device_password_id,omitempty"`
DeviceName string `json:"device_name,omitempty"`
Manufacturer string `json:"manufacturer,omitempty"`
ModelName string `json:"model_name,omitempty"`
Notes []string `json:"notes,omitempty"`
}
WSC is the decoded view of a WPS information-element body.
func Decode ¶
Decode parses a hex-encoded WPS IE body into its WSC attributes. The input may be the bare WSC attribute stream, the manufacturer payload prefixed with the OUI+type (00 50 F2 04 …), or the full vendor-specific Information Element (DD <len> 00 50 F2 04 …); the recognised prefix is stripped.
func DecodeBytes ¶
DecodeBytes walks a bare WSC attribute stream.
Source Files