WPS is a flawed wireless network security standard. While it simplifies connectivity, it is also susceptible to attacks. An attacker within radio range can brute-force the WPS PIN of a vulnerable access point, retrieve WEP or WPA passwords, and potentially gain access to the Wi-Fi network. However, the attacker must first identify a vulnerable access point. Which of the following tools can be used to detect WPS-enabled access points?