WPS Lockout and PMKID on a Retail AP
A retail store runs a single AP with WPA2-PSK (AES-CCMP) and WPS enabled in PIN mode. The passphrase is 14 characters, mixed case and digits. The AP is a consumer model whose WPS implementation locks PIN attempts for 60 seconds after five failures, but the lockout is tracked by source MAC address. You have a client associated and can capture traffic. The store owner will not authorize a physical reset. You need to determine whether WPS or PMKID is the better path, and whether offline cracking is realistic within a 6-hour window using a single RTX 3060. You also notice the AP advertises WPA2/WPA3 transition mode on a second SSID, but the legacy POS terminal connects only to the WPA2 SSID.
1. Assess the WPS PIN lockout and whether MAC-address rotation changes the feasibility. What evidence would you collect first?
Read the worked answer
First fingerprint WPS: wash -i wlan0mon -C to see WPS version, locked flag, and AP PIN behavior. A 60-second lockout after five failures is only 300 attempts/hour; at roughly 11,000 PINs (the last digit is a checksum) that is about 36 hours, outside the 6-hour window. If the lockout is per source MAC, rotating the MAC may reset the counter on some consumer APs, but many track the AP's WPS state and will still lock. Test carefully with one MAC change and watch the 'WPS locked' flag; do not assume bypass. Also check for Pixie Dust (reaver -K 1) because a vulnerable chipset can recover the PIN from one exchange regardless of lockout. Evidence first: WPS version, lock state, and whether the AP accepts an external registrar.
2. Compare PMKID capture and 4-way handshake capture for offline cracking under the constraints.
Read the worked answer
Both PMKID and 4-way capture end in the same offline PBKDF2-HMAC-SHA1 calculation (hashcat mode 22000), so the GPU cost is identical. PMKID is operationally better here because it needs only EAPOL message 1 and no deauth, reducing disruption; the 4-way handshake requires a client reconnect and a clean capture. The real constraint is the 14-character mixed passphrase: a single RTX 3060 can test only a limited candidate space, so brute force is not realistic. Use a curated wordlist with rules based on store name, location, and seasons; if that fails, WPS Pixie Dust is the only plausible path. Do not promise success from GPU speed alone.
3. The second SSID is WPA3 transition mode. What additional risk does transition mode introduce, and would you target it?
Read the worked answer
Transition mode advertises WPA2 and WPA3 on the same SSID, so the AP must accept WPA2 clients. That preserves the WPA2 4-way handshake and PMKID attack surface, and it can enable downgrade-style attacks against clients that would otherwise use SAE. However, it does not make the 14-character PSK easier to crack; it only gives you more capture options. Target the WPA2 side for capture, but do not ignore the POS terminal: if it is WPA2-only, it may be the weakest client. If PMF is optional, deauth may still work on non-PMF clients.