A municipal red team wants a quick map of which access points advertise WPS capability before deeper testing. Which tool-purpose class fits that recon goal?
Select an answer to reveal the explanation.
Short Explanation
Want a cheat sheet of APs that still wave the WPS flag? Use a wash-class discovery pass—it is recon, not the full attack. Map candidates first; deeper WPS testing only if scope and RoE say so.
Full Explanation
For a quick map of which municipal access points advertise WPS capability before deeper testing, a specialized WPS discovery scanner in the wash-class purpose family fits: it reads WPS-related information from beacons/probe responses to flag WPS-capable AP candidates. That recon step helps city teams prioritize where WPS-focused testing might apply—only if RoE allows—without inventing PSKs or pivoting into phishing kits during survey. A wordlist generator that invents PSKs without observing AP beacons fails by concept: it does not discover WPS capability on the air. A cabling toner that traces Ethernet drops fails by concept: physical cable tracing is not WPS advertisement discovery. A captive-portal HTML phishing kit fails by concept: phishing tooling is not a WPS capability survey method and is usually out of recon scope. Exam caveat: WPS capability advertisements are not automatic permission to run WPS attacks—many civic RoEs ban or tightly limit WPS exploitation even when wash-class tools flag Locked/Unlocked states. Operational check: run an authorized wash-class scan on in-scope channels, record which city BSSIDs advertise WPS, compare to the hardened baseline, and only proceed to deeper WPS tests if the RoE annex explicitly allows them.