Reaver implements a brute-force attack against WiFi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases. It exploits a design flaw in WPS that reduces the PIN keyspace from 10^8 to approximately 11,000 attempts, making WPS-enabled routers vulnerable.