Home - Wireless Cracking - Default Router WPA Keys - Keyspace Used

Found that SmartRG routers ship out with default SSID of SmartRG-XXXX and the password is the MAC address of the device (lowercase). [0-9],[a-f]

However, one of the local ISPs to my area change the SSID and password to the following format:

SSID: [last name of customer aka "smith"]
Password: [Customer's phone number] ([0-9] length 10 (9071234567))

Note: this has been a pattern i've observed in all the smartRG routers I have encountered in the last 6 months (15-20 routers) may not be true for all SmartRG routers.

+rep if I helped. GTX 750 Ti & GTX 550
Github: https://github.com/PurpleNinja225/Hash-Cracking Discord: PurpleNinja225 #6785

Tipz Jar:
BTC 321aVnFwQrhZcHoCoPzp1Vh46rUiQmExzp
ETH 0xF5ab8429F6991f0232Dd4A0eB8318a4e172b1282

Recompiled the list in the first post as well as added some routers from other forums that have similar posts into a nice and pretty excel sheet. The sheet can be sorted by the different headers to get a better idea of everything. Here it all is as well as the file for offline use. Also, not all the hypelinks copied correctly, you'll just have to manually copy and paste them into a browser to open.

Note: I don't take credit for originally obtaining this info, I just gathered it from a couple places and made it look a little more organized.

Let me know if I missed anything or made a mistake.

SSID Keyspace Length Notes

2WIREXXX [0-9] Len: 10

3MobileWiFi [0-9 a-z] Len: 8

3WebCube#### [0-9a-fA-F] Len: 8 https://routerunlock.com/wp-content/uploads/2014/06/Huawei-B190-LTE-Wireless-Gateway.png

3Wireless-Modem-XXXX [0-9A-F] Len: 8 The first 4 digits are the same as the 4 digits on the SSID http://ask3.three.ie/ROIWebdocs/Changes/Mobile%20Broadband%20Support/Setting%20up%20Mi-Fi/Images/4.JPG

Alice_XXXXXXXX [0-9 a-z] Len: 24

AOLBB-XXXXXX [0-9A-Z] Len: 8

ATT### [0-9] Len: 10

ATTxxxx 0000 [0-9 A-Z] Len: 10

ATTxxxxxxx [a-z symbols] Len: 12

belkin.xxx [2-9a-f] Len: 8

belkin.xxxx [2-9a-f] Len: 8

Belkin.XXXX [0-9A-F] Len: 8

Belkin_XXXXXX [0-9A-F] Len: 8

BELL### [0-9A-F] Len: 8

BELL#### [0-9A-F] Len: 10

BigPondXXXXXX [0-9A-F] Len: 10 http://s22.postimg.org/w7qofyxj5/Big_Pond_XXXXXX_Technicolor_TG587nv3.png

BOLT!SUPER 4G-XXXX [0-9 Last 4 of SSID] Len: 8 4 numbers + Last 4 of SSID

BrightBox-XXXXXX [word-word-word] Len: 8 3 words, with hyphens in-between.

BTHomeHub2-XXXX [2-9a-f] Len: 10

BTHomeHub-XXXX [0-9a-f] Len: 10

BTHub3 [2-9a-f] Len: 10

BTHub4 [2-9a-f] Len: 10

BTHub5 [2-9a-f] Len: 10

BTHub6-XXXX [0-9a-zA-Z] Len: 10 or 12 Examples: http://cdn1.expertreviews.co.uk/sites/expertreviews/files/2016/06/bt_smarthub_rear_ports.jpg?itok=gCga5sn8 http://cdn2.pcadvisor.co.uk/cmsdata/reviews/3643011/bt-smart-hub-review---ports.jpg

CenturyLinkXXXX [0-9a-f] Len:14

Cisco [0-9a-f] Len: 26

Digicom_XXXX [0-9 A-Z] Len: 8

DJAWEB_##### [0-9] Len: 10

Domino-XXXX [0-9A-F] Len: 8 http://imagizer.imageshack.us/a/img855/6808/fs7j.jpg

E583x-xxxx [0-9] Len: 8 http://4.bp.blogspot.com/-KsB8p6EQeMY/UKD9iA8SkLI/AAAAAAAAEcM/v7Bq2kdHu2E/s1600/ssid-huawei-modem-e5830.jpg

E583x-xxxxx [0-9A-F] Len: 8 https://encrypted-tbn1.gstatic.com/images?q=tbn:ANd9GcRZz7DlK9S1yhG4PmZYoJh3j4Os3o9IVj30CZpLzBU0r9pWPTNC

EasyBox 904 LTE [0-9a-zA-Z] Len: 9

EasyBox-###### [0-9A-F] Len: 9 http://www.arcor.de/hilfe/files/img/803s_Typenschild.png

EEBrightBox-XXXXXX [word-word-word] Len: Varies http://forum.md5decrypter.co.uk/topic1660-brightbox.aspx and https://hashkiller.co.uk/dump/brightbox_extended.7z

FRITZ!Box Fon WLAN #### [0-9] Len:16 https://wiki.stipte.nl/images/c/c9/Fritz!box7113_wpakey.png

FrontierXXXX [0-9] Len: 10

Hitron [0-9 A-Z] Len: 12 Serial # possible key

INFINITUM#### [0-9] Len: 10 http://www.websec.ca/img/mac2wepkey/image12.png

iPhone 5 Lowercase word plus 4 # ??

Keenetic-XXXX [a-zA-Z0-9] Len: 8

Linkem_XXXXXX [0-9] Len: 8

Livebox-XXXX ?? ??

MEO-###### [0-9A-F] Len: 10 https://www.wifi-libre.com/img/members/96/DATOS-MEO.jpg

mifi2 [0-9 A-Z] Len: 13

MobileWifi-xxxx [0-9] Len: 8

MYWIFI (EE) [MYWIFI + 4 numbers] Len: 10

NETGEARXX [Adjective + Noun + 3 Digits] Len: Varies https://hashcat.net/forum/thread-4463.html

Netia-XXXXXX [0-9a-f] Len:13 http://www.pomagam.net/images/asmax/P2290215.png

ONOXXXX [0-9] Len: 10

Orange-0a0aa0 [0-9a-f] Len: 8

Orange-AA0A00 [0-9A-F] Len: 12

Orange-XXXX [2345679ACEF] Len: 8

PLDT [PLDTWIFI + Last 5 of MAC] Len: 13

Plusnet Broadband UK [0-9a-zA-Z] Len: 64

PlusnetWireless-XXXXXX [0-9A-F] Len: 10

PLUSNET-XXXXXX [0-9a-f] Len: 10 Possible [2-9a-f]

Sitecom_XXXX [0-9A-F] Len: 8

SKYXXXXX [A-Z] Len: 8 http://www.ph-mb.com/products/sky-calc

SmartRG [0-9a-f] Len: 10 Default pasword is the MAC address

SpeedTouchXXXXXX [0-9a-f] Len: 10

TALKTALK-XXXXXX [346789ABCDEFGHJKMNPQRTUVWXY] Len: 8

TDC-#### [0-9a-f] Len: 9 Possible [1-9a-f]

Tech_XXXXXXXX [A-Z] Len: 8 http://www.netia.pl/files/pomoc/tech_instr.pdf

Technicolor-Router [0-9A-F] Len: 10

Telecom-XXXXXXXX ?? ?? http://www.dreamsnet.it/wp-content/uploads/router-alice-ip-aleternativo-indirizzo-mac.jpg

TelstraXXXXXX [0-9A-F] Len: 10 http://s9.postimg.org/6nocruw5b/Telstra_XXXXXX_Technicolor_TG797nv3.png

TELUSXXXX [0-9a-f] Len: 10

TEW-###DRU ###+ last 8 of serial] Len: 11 https://forums.kali.org/showthread.php?26366-TRENDnet-WPA-disclosure-amp-dictionaries

Thomson [0-9A-F] Len: 10

ThomsonXXXXXX [0-9a-f] Len: 10

TIM_PN51T_XXXX [0-9] Len: 8 WPS pin is 12345670 WPS can't be disabled

TNCAP-XXXX [0-9A-F] Len: 10

TNCAPXXXXXX [0-9A-F] Len: 10 http://www.crack-wifi.com/forum/topic-9372-technicolor-td5130-0018e7.html

TP-LINK_#### [0-9] Len: 8

TP-LINK_###### [0-9A-F] Len: 8

TRENDnetXXX-###XXX [### of SSID ?d?d?d?d?d?d?d?d] Len: 11 https://forum.hashkiller.co.uk/topic-view.aspx?t=2715&m=108547#108547

TRKASHI-###### [?d?d######] Len: 8 https://forum.hashkiller.co.uk/topic-view.aspx?t=2715&m=64032#64032

UNITE-XXXX [0-9] Len: 8 http://chipchickcom.wpengine.netdna-cdn.com/wp-content/uploads/2013/01/screenshot_733.jpg

UPCXXXXXXX [A-Z] Len: 8

Verizon MIFIXXXX XXXX [0-9] Len: 11 http://www.willhackforsushi.com/images/mifi-label.jpg

Virgin Media [abcdefghjklmnpqrstuvwxyz] Len: 8

virginmediaXXXXXX [abcdefghjklmnpqrstuvwxyz] Len: 8 I and o omitted

VirginMobile MiFiXXXX XXX [0-9] Len: 11 https://theonbutton.files.wordpress.com/2010/09/virgin-mobile-mifi-2200-battery.jpg

VMXXXXXXX [0-9a-zA-Z] Len:12 https://forum.hashkiller.co.uk/topic-view.aspx?t=2715&m=100456#100456

VMXXXXXXX-2G [abcdefghjklmnpqrstuvwxyz] Len: 8 I and o omitted

VMXXXXXXX-5G [abcdefghjklmnpqrstuvwxyz] Len: 8 I and o omitted http://store.virginmedia.com/images/discover/help2/topics/hub_05.jpg

Vodaphone_XXXXXXXX [0-9 a-z] Len: 15

WebCube#### [0-9A-F] Len: 8 https://images.futurezone.at/cube_2.jpg/fuzo-slideshow-slide/24.549.231

WLAN1-XXXXXX [0-9A-F] Len: 10 http://www.4gltemall.com/blog/wp-content/uploads/2013/10/Back-stick-of-HUAWEI-B593u-12.jpg

ZyXELXXXXXX [10:0-9 A-F][13:0-9 A-Z] Len: 10 or 13

+rep if I helped. GTX 750 Ti & GTX 550
Github: https://github.com/PurpleNinja225/Hash-Cracking Discord: PurpleNinja225 #6785

Tipz Jar:
BTC 321aVnFwQrhZcHoCoPzp1Vh46rUiQmExzp
ETH 0xF5ab8429F6991f0232Dd4A0eB8318a4e172b1282

Linkem old version as only [0-9] keyspace, while the new one, which is in the form Linkem_2.4GHzXXXXXX is [0-9][a-z]

Thanks @sjackjacka I'll update the list!

+rep if I helped. GTX 750 Ti & GTX 550
Github: https://github.com/PurpleNinja225/Hash-Cracking Discord: PurpleNinja225 #6785

Tipz Jar:
BTC 321aVnFwQrhZcHoCoPzp1Vh46rUiQmExzp
ETH 0xF5ab8429F6991f0232Dd4A0eB8318a4e172b1282

Does anyone know the default keyspace for

UPCXXXXXXXXX

| UPC240928716 | 9U7QTAEA |
| UPC241343196 | KJUUVTYB |
| UPC241423698 | WVMTNVQD |
| UPC242831215 | DJUHPKBF |
| UPC244581310 | PJVHTUVT |
| UPC245822946 | KFSDJBQB |
| UPC247061299 | ZAXDGXCW |
| UPC248169666 | MPFSDPPY |
| UPC248316942 | KH7GLXQG |

GPUHASH.me team official representative
Support, discounts, free offers for forum members

So, I guess I should just try bruteforcing the captured Handshake using 8 Uppercase letters. A few hours?

That would be a good start. It looks like it's possible for at least 1 digit to be present though.

+rep if I helped. GTX 750 Ti & GTX 550
Github: https://github.com/PurpleNinja225/Hash-Cracking Discord: PurpleNinja225 #6785

Tipz Jar:
BTC 321aVnFwQrhZcHoCoPzp1Vh46rUiQmExzp
ETH 0xF5ab8429F6991f0232Dd4A0eB8318a4e172b1282

8 uppercase letters default password is for UPCXXXXXXX (X - digit). As you can see from the above list we have digits sometimes in real passwords of UPCXXXXXXXXX (X-digit). But we don't have enough samples to say if they used all digits 0-9 or just part like TALKTALK passwords.

GPUHASH.me team official representative
Support, discounts, free offers for forum members

TALKTALKXXXXXX
a4:71:74:35:73:6c

SKYXXXXX
c0:3e:0f:de:1d:19

SKYXXXXX
78:3e:53:8b:6f:f6

TALKTALKXXXXXX
20:a6:80:5d:e7:88

TALKTALKXXXXXX
40:9b:cd:05:b0:b2

SKYXXXXX
70:50:af:7f:99:62

HELLO somebody have any pins

TALKTALK-XXXXXX is

346789ABCDEFGHJKMNPQRTUVWXY,?1?1?1?1?1?1?1?1

SKYXXXXX is
?u,?1?1?1?1?1?1?1?1

see http://www.ph-mb.com/products/sky-calc

My haschat stuff (rules, scripts): https://github.com/theherp/Hashcat-stuff
BTC: 3C2h4xscGRq7XfZLicoVjRVkYrqqJ1Urc5

What about
Cambridge Industries

Tenda W150D / W150D-u / D301

W150D
1, https://prnt.sc/kllxi4 https://prnt.sc/kllvuw

c8:a3:35:37:e6:21 3537E620

2, https://prnt.sc/klmag1
c8:3a:35:3d:29:50 353D2950

W150D-u
1, https://prnt.sc/kllwkw

c8:3a:35:5c:8d:10 355C8D10

D301
1, http://prntscr.com/klmelu

c8:3a:35:83:82:50 35838250

PTCL use them

C8:3A:35:93:AB:F9 3593ABF8

ok so Tenda W150D / W150D-u / D301 uses the last 8 char of the mac as the password.

last 2 didgit might change , char up or down as u can see here c8:a3:35:37:e6:21 3537E620

so basicly that should be
-m 2500 -a 3 c8:a3:35:37:e6:21.hccapx -1 ?d?u 3537E6?1?1

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

SSID: TTNET_ZyXEL_XXXX
BSSID: 60:31:97:5B:15:BA

SSID: TTNET_ZyXEL_XXXX
BSSID: 58:8B:F3:5A:1B:9C

Hello anyone know about the keyspace?. GPUHash cracked it under 2 minutes

WARNING! User is BANNED and maybe a SCAMMER.

Can you not tell from gpuhash results?
Or do you just use them as passphrase strength test without any intention to pay?

No. I used this service and paid for the password many times. But i'm short on bitcoin these days. I wanna know the keyspace,because these networks are common around my area. Sorry if i did something against the rules.

why dont u tell us the result u received from gpuhash ?

telling us the mac and the ssid wont really help us figure out whats the pattern if u dont tell us the password u received ..

just to recap (idk why u did not put the full name but)

SSID: TTNET_ZyXEL_XXXX > TTNET_ZyXEL_K4R4
BSSID: 60:31:97:5B:15:BA

SSID: TTNET_ZyXEL_XXXX > TTNET_ZyXEL_AYP7
BSSID: 58:8B:F3:5A:1B:9C

i dont see any pattern

https://www.technopat.net/sosyal/eklenti/a-jpg.172143/
https://store.donanimhaber.com/76/51/86/76518670bde7e8cbc17bd888cac7aa5b.JPG
https://d1rn3d78e3d9hc.cloudfront.net/product_images/2016-52/a3b88e7d-be8a-48c8-b69e-348cfe8025eb.jpeg
https://store.donanimhaber.com/23/67/70/236770d6d0e6b3c41c856f154442e645.jpg
https://teknoseyir.com/wp-content/uploads/2017/07/795be74beb2527c-950x713.jpg
https://teknoseyir.com/wp-content/uploads/2017/07/60714b017b3e461-713x950.jpg
http://img.donanimhaber.com/upfiles/2340919/9217aa66-89fc-4805-98dc-8a33cc81e6e4.jpg
https://store.donanimhaber.com/6b/04/d2/6b04d2e2fa76dc2ad951fd5af8cbc827.jpg
https://store.donanimhaber.com/83/89/1e/83891ef5c133438f13eda7f02a83cc93.jpg

UPDATE:
i do see there is at least 6 digit.
and the letters are up to F so , a-f with at least 6 didgit.

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

at least 7 digit sorry.

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

i did create a hcmask for ya, however i think that will take u some time to complete all of it.

http://rgho.st/8lnvhkcDm
https://www.sendspace.com/file/mjlk9k

https://paste.hashkiller.co.uk/DAqYcKeBEeiA_ECNXEjIzQ

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

Wow! Thznk you for your help. I'm gonna try this right away

mind sharing the password u received from gpuhash ?

wana be certain of what i said.

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

just ?H for upper hex

it has do with serial number
wont find pattern just by look at pics
example of algo with python and info posts see
https://forum.hashkiller.co.uk/topic-view.aspx?t=19944

why upper hex ?
just upper letters (and digit) . ?u ?d
u right about skipping out most letters instead of going thought all the a-z .
but those are just 2 chars so no big deal there.

i saw TTNET thread but it requires the serial number to work. (to spit out the password )

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

i would like to add another one to the list.

i know its been posted else where but not in here. (at least not updated to the main thread)

so SHAW-XXXX routers have 2 patters. (that known today)
some are:
1, LEN [9] ?d?d?d?d?d?d?d?d?d
2, LEN [12] -2 ABCDEF0123456789 2511?2?20?2?2?2?d?d

can be find here https://forum.hashkiller.co.uk/topic-view.aspx?t=20651&m=148755#148755 and https://forum.hashkiller.co.uk/topic-view.aspx?t=2715&m=149551#149551 and https://hackforums.net/showthread.php?tid=5618355&pid=56756683#pid56756683

for simplicity:

-3 a -m 2500 hash.hccapx ?d?d?d?d?d?d?d?d?d

-3 a -m 2500 hash.hccapx -2 ABCDEF0123456789 2511?2?20?2?2?2?d?d

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

TTNET_ZyXEL_K4R4:f49A850662b34

I've made a wordlist uding that python script with posible Serial numbers (S1X0YXXXXXXXX)it worked.

same here.
the other way is creating a wordlist with all serial combination.
each wordlist weight around 1.5gb (for each serial aka, S150Y,S140Y...)

+rep if i helped
BTC : 1PAyKniGHt7yyCb8HdsziTHBEFX6zkGSHz

hello

How can I create a Wordlist in your hand? or upload please thank you. sample routers password

SERIAL NUMBER MAC ID/ACS SSID PASSWORD
S150Y22033172 E8377AAF1DD5 TTNET_ZyXEL_Y4AR c97BdB95fD5E6
S160Y03145389 04BF6D9E2476 TTNET_ZyXEL_74XK 8C0B14cC120D1
S140Y03095523 107BEFBDE432 TTNET_ZyXEL_VC37 c8d4819Be1a26
S140Y40014445 90EF684DE461 TTNET_ZyXEL_VXJF 26b6166E03874
S140Y03093277 107BEFBD695E TTNET_ZyXEL_X3XR 330A4F4E645Be

I have list but over 5 GB I try to compress but only %50 compress with best compress with 7zip. So My home network upload speed not enough for upload 2.5 gb file. But İf you send me your handshake. I can try

Not: Are you turkish people?

yes I'm Turkish

I have a handshake but I get the password with fluxion. I need to create WordList TTNET pyhton algoritm. how did you create?

evet türküm
elimde handshake var ama zaten şifreyi fluxion ile kırdım. TTNET phyton algoritması ile Wordlist oluşturmaya ihtiyacım var. Siz nasıl oluşturdunuz?