Bully is a high-performance, C-implemented wireless security utility included in Kali Linux that is designed to perform brute-force attacks against Wi-Fi Protected Setup (WPS). It exploits a well-known architectural design flaw in the WPS specification to recover WPA/WPA2 passphrases from vulnerable wireless access points. [1, 2, 3, 4]
Compared to older utilities like Reaver, Bully offers optimized CPU and memory consumption, direct handling of endianness, better anomaly detection, and fewer operational dependencies. [1, 2]
Key Capabilities & Mechanics
- WPS Flaw Exploitation: WPS authentication validates a 8-digit PIN in two separate halves. Bully leverages this to reduce the potential problem space from 10⁸ total combinations down to just 11,000 attempts (10⁴ for the first half, 10³ for the second half).
- Pixiewps Integration: It supports offline cracking via Pixie-Dust attacks using the
-dargument, cutting down attack time dramatically if the target access point generates weak cryptographic nonces. [1, 2] - Adaptive Lock Handling: It includes arguments (
-l,-L,-D) engineered to detect, bypass, or gracefully pause execution when routers invoke WPS lockout defense protocols. [1]