NEW: We have a Discord server now. Click here to go there now!

NOTE: Why not use our List Manager to crack your lists? Its easy and enables better management.

NOTE: When cracking WPA/WPA2 passwords, make sure you check gpuhash.me first incase it's already been processed.

Home - Wireless Cracking - Default Router WPA Keys - Keyspace Used


409 Results - Page 3 of 14 -
1 2 3 4 5 6 7 8 9 10 11 12 13 14
Author Message
Avatar
Caoimhín
Administrator
Status: Elite
Joined: Sat, 29 Dec 2012
Posts: 3251
Team:
Reputation: 5065 Reputation
Offline
Sat, 21 Feb 2015 @ 22:38:24

Did not see this one on the growing list.

The so called TalkTalk Super Hub (fibre)

Note: ssid has no hyphen, unlike last model.

TALKTALKXXXXXX

Model: Huawei hg635

Length: 8

Charset: 0-9A-Z

Confirmation needed to see if i & o characters are omitted from the charset.



BTC - 1CkFbxQHz9Ab2TK4gydTfkpEWmPep3qDRU

Avatar
domdom

Status: n/a
Joined: Tue, 30 Dec 2014
Posts: 31
Team:
Reputation: 0 Reputation
Offline
Wed, 25 Feb 2015 @ 14:25:37

can any one tell me what Broken algo! means in speed touch routers



Avatar
casha

Status: n/a
Joined: Wed, 25 Feb 2015
Posts: 25
Team:
Reputation: 40 Reputation
Offline
Wed, 25 Feb 2015 @ 23:24:00

Poland
NETIASPOT_XXXXXX - [0-9a-z] Len: 12
http://www.pomagam.net/images/NetiaSpotdol.png


BTC: 1AMGPqQPunooWLQ3wyjcCkcDe2JjJ2i5t8

PL

Avatar
jugganuts420

Status: Member
Joined: Sat, 21 Feb 2015
Posts: 318
Team:
Reputation: 317 Reputation
Offline
Thu, 26 Feb 2015 @ 18:03:44

domdom said:

can any one tell me what Broken algo! means in speed touch routers


It means broken algorithem.


+rep if i helped :)

Avatar
Caoimhín
Administrator
Status: Elite
Joined: Sat, 29 Dec 2012
Posts: 3251
Team:
Reputation: 5065 Reputation
Offline
Thu, 26 Feb 2015 @ 19:33:32

domdom said:

can any one tell me what Broken algo! means in speed touch routers


Read - http://www.gnucitizen.org/blog/default-key-algorithm-in-thomson-and-bt-home-hub-routers/



BTC - 1CkFbxQHz9Ab2TK4gydTfkpEWmPep3qDRU

Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Mon, 09 Mar 2015 @ 19:45:00

I have tided and sorted the main list from the first post. It was such a dramatic change I thought I would post it here rather than overwrite the first one. It gives others chance to see if I have made a mistake

I think we need some sort of spreadsheet to display these better in future. I guess it would also be a good idea to list optimised character order too.

Blandy said Sky should be starting with.... HEWICULFBSPGQMRXZVTNKYADOJ .... Milzo certainly didn't say it !

Anyone got any more ?

Here is the list....

2WIREXXX - [0-9] Length 10 (Common AT&T DSL routers in the USA.)
3Wireless Modem XXXX - [0-9A-F] (first 4 digits of ESSID then 4 x [0-9A-F]) Length 8
ATT?d?d?d - [0-9] Length 10
belkin.xxx - [2-9a-f] length 8
Belkin.XXXX - [0-9a-f] Length 8
belkin.XXXX - [2-9a-f] length 8
Belkin_XXXXXX - [0-9A-F] Length 8
BrightBox - 3 Words separated by "-" Example dizzy-tool-cat Lengths 3-4-5 or any combination.
BTHomeHub1XXXX - [0-9a-f] (Broken algorithm) Length 10
BTHomeHub2XXXX - [2-9a-f] (0 and 1 omitted) Length 10
BTHub3 - [2-9a-f] (0 and 1 omitted) Length 10
BTHub4 - [2-9a-f] (0 and 1 omitted) Length 10
CenturyLinkXXXX - [0-9a-f] Length 14
DJAWEB_xxxxx - [0-9] Length 10
Domino-XXXX - [0-9A-F] Length 8
E583x-xxxx - [0-9] Length 8
E583x-xxxxx - [0-9A-F] Length 8
EasyBox-xxxxxx - [0-9A-F] Length 9
EE-BrightBox - 3 Words separated by "-" Example dizzy-tool-cat Lengths 3-4-5 or any combination.
FRITZ!Box Fon WLAN xxxx - [0-9] Length 16
Iphone 5 lower alpha + 4 numbers Example hello1234
Keenetic-XXXX - [a-zA-Z0-9] Length 8
Livebox-XXXX - Impossible
mifi2 - [A-Z0-9] Length 13
MobileWifi-xxxx - [0-9] Length 8
NETGEARXX - Adjective + Noun + 3 Digits SSID: NETGEAR37 KEY: vastcoconut260
ONOXXXX - [0-9] Length 10
Orange - ?d?l?d?l?l?d - [0-9a-f] Length 8
Orange - ?u?u?d?u?d?d - [0-9A-F] Length 12
Orange-XXXX - [2345679ACEF] Length 8
Plusnet Broadband UK - [a-zA-Z0-9] Length 64
PlusnetWireless-XXXXXX - [0-9A-F] Length 10
SKYXXXXX - [A-Z] Length 8
SpeedTouchXXXXXX - [0-9a-f] Length 10 (Broken algorithm)
SSID: NETGEAR37 KEY: Adjective + Noun + 3 Digits Example vastcoconut260
TALKTALK-XXXXXX - [ABCDEFGHJKMNPQRTUVWXY346789] (ILOSZ0125 omitted) Length 8
Technicolor-Router [0-9A-F] Length 10
Thomson - [0-9A-F] Length 10
ThomsonXXXXXX - [0-9a-f] Length 10
TNCAP-XXXX [0-9A-F] Length 10
TNCAPXXXXXX - [0-9A-F] Length 10
TP-LINK_xxxxxx - [0-9A-F] Length 8
UNITE-XXXX - [0-9] Length 8
UPCXXXXXXX - [A-Z] Length 8
Verizon MIFIXXXX XXXX - [0-9] Length 11
Virgin Media - [abcdefghjklmnpqrstuvwxyz] (0 and i omitted) Length 8
Virgin Mobile - MiFiXXXX XXX - [0-9] Length 11
VMXXXXXXX 2G - [abcdefghjklmnpqrstuvwxyz] (0 and i omitted) Length 8
VMXXXXXXX 5G - [abcdefghjklmnpqrstuvwxyz] (0 and i omitted) Length 8
ZyXELXXXXXX - [0-9A-Z] Length 13


Edit

I never admit to editing


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
Caoimhín
Administrator
Status: Elite
Joined: Sat, 29 Dec 2012
Posts: 3251
Team:
Reputation: 5065 Reputation
Offline
Mon, 09 Mar 2015 @ 19:47:02

"I think Milzo said....."

It's was blandy btw

Domino-XXXX - [0-9A-F] Length 8

UNITE-XXXX - [0-9] Length 8

duplicate entries.


BTC - 1CkFbxQHz9Ab2TK4gydTfkpEWmPep3qDRU

Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Mon, 09 Mar 2015 @ 19:48:51

Looks like I "thought" wrong

It's all lies, I haven't used my edit button to remove those duplications, honest


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
Birdy_UK

Status: Banned
Joined: Fri, 13 Mar 2015
Posts: 5
Team:
Reputation: 0 Reputation
Offline
Tue, 17 Mar 2015 @ 01:17:43

WARNING! User is BANNED and maybe a SCAMMER.

Hi guys, Not sure if this info is any good to you.. i bought this from a car boot this week lol..

SKY HUB

SSID: SKYDD9C6
PASS: AUWQCWYX
PIN: 30472952
SERIAL: A00012BC007725

Cheers


Avatar
jugganuts420

Status: Member
Joined: Sat, 21 Feb 2015
Posts: 318
Team:
Reputation: 317 Reputation
Offline
Sun, 05 Apr 2015 @ 02:05:58

I dont see many linksys routers posted so here's one




+rep if i helped :)

Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Sun, 05 Apr 2015 @ 02:13:11

jugganuts420 said:

I dont see many linksys routers posted so here's one

Good info, thank you for sharing.

Wow that WPA password looks tough !


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
halsandr

Status: n/a
Joined: Fri, 13 Jun 2014
Posts: 25
Team:
Reputation: 0 Reputation
Offline
Mon, 27 Apr 2015 @ 19:20:45

Have any of you come across a "BTHomeSpot-XXX" box yet? im about to start testing the WPA on one and wondered if anyone knew the keyspace?

I am going to presume (until advised otherwise) that it is a wireless extender for a HomeHub4 box, so the keyspace should be the same...but that is a total shot in the dark.


Avatar
Poppy

Status: n/a
Joined: Tue, 05 May 2015
Posts: 55
Team:
Reputation: 108 Reputation
Offline
Wed, 06 May 2015 @ 00:45:15

there are two more variations of ATT routers

ATTxxxx ?d?d?d?d - [0-9A-Z] Len: 10 (possibly has some sort of letters removed)
http://s8.postimg.org/mehdvfnqt/ATTXXXX_01.jpg
http://s8.postimg.org/8m2yzswz9/ATTXXXX_03.jpg
http://sishardware.com/imgs/a/b/a/l/d/att_westell_netgear_7550_dsl_modem_router_gateway_b90___7550025___15_802___11n_att_2_lgw.jpg

ATTxxxxxxx (Like: ATTjuKEVS2 ) - usually [a-z] and symbols, but sometimes [a-z0-9] and symbols Len: 12
http://s14.postimg.org/6ttxb4p7l/ATTxxxxxxx_01.jpg
http://s14.postimg.org/ujjcztnkx/ATTxxxxxxx_03.jpg

HOME-XXXX [0-9A-F] usually last 2 bytes of CM MAC, sometimes differ a little. Used by XFINITY/Comcast provider

HOME-XXXX - ARRIR Router [0-9A-F] Len: 16
http://s8.postimg.org/a42pnhzat/home_xxxx_03.jpg
http://s8.postimg.org/m4o5o86ph/home_xxxx_04.jpg

HOME-XXXX - SMC Router network key: S/N + [0-9A-F] Len: 4
http://s12.postimg.org/kc9onsr25/home_xxxx_01.jpg

HOME-XXXX - CISCO Router :? reffer to link below
http://s8.postimg.org/h11hdrkz9/home_xxxx_05.jpg
http://s8.postimg.org/xq2x9ohkl/home_xxxx_06.jpg


Avatar
agentshield

Status: n/a
Joined: Thu, 28 May 2015
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Thu, 28 May 2015 @ 07:47:47

On comcast/xfinity SMC branded router you can get the wps pin by converting the last 6 values of the mac address from hex to dec.

if the results of the conversion gives u 8 digits then u drop the first digit and run the remaining 7 digits thru reaver with -p


Avatar
jugganuts420

Status: Member
Joined: Sat, 21 Feb 2015
Posts: 318
Team:
Reputation: 317 Reputation
Offline
Mon, 15 Jun 2015 @ 16:11:33

Here is a takashi wireless repeater



+rep if i helped :)

Avatar
blandyuk
Admin / Owner
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3214
Team: HashKiller
Reputation: 4165 Reputation
Offline
Mon, 15 Jun 2015 @ 16:58:17

Wow!! Totally broken lol

Adding...


Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 1JZGVq58m4RS1QQS8JE5xndzDFy2BvGU6y
GPU Power: 9x GTX 1070 + 6x GTX 1080

Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Mon, 15 Jun 2015 @ 17:18:44

LOL That's funny !

Thanks for sharing, lets hope other manufacturers adopt that method !!


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
raiL

Status: n/a
Joined: Sat, 20 Jun 2015
Posts: 2
Team:
Reputation: 0 Reputation
Offline
Sat, 20 Jun 2015 @ 21:22:20

Hello, anyone interested in a little database of UPC routers with ssid/mac/password for research? Been trying to find a common element with no success...

They're somewhat easy to bruteforce, but finding an algorithm for them would be cool.


Attachments: Login to view attachments.
Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Sat, 20 Jun 2015 @ 22:03:14

raiL said:

Hello, anyone interested in a little database of UPC routers with ssid/mac/password for research?

Yes, we are always interested in genuine found passwords.

Thanks for sharing.


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
raiL

Status: n/a
Joined: Sat, 20 Jun 2015
Posts: 2
Team:
Reputation: 0 Reputation
Offline
Wed, 24 Jun 2015 @ 20:59:17

So...anyone already looked into these UPC routers? I'm still thinking about the algorithm and I got an idea. Sadly, I'm no good in coding and even less in maths (tried Wolfram Mathematica today and I think I've found my n°1 enemy in it). This idea could work for other routers too - don't blame me for discovering America once again:

1) assign a number 1-26 to every letter in the password
2) convert last 2-4-6-8-10 chars of MAC into decimal
3) use operator/operand variations brute force and compare the results with 2)

This would work like:

MAC 01:23:45:67:89:AB
PASS ABCDEFGH => 12345678 => 1+2+3+4+5+6+7+8, 1+2+3+4+5+6+7-8, 1+2+3+4+5+6+7*8...

I will continue tomorrow, getting sleepy here


Avatar
fsociety_29

Status: n/a
Joined: Fri, 31 Jul 2015
Posts: 1
Team:
Reputation: 10 Reputation
Offline
Fri, 31 Jul 2015 @ 19:47:42

Wanted to drop by and give back, you've helped me a bit, so it's only right I help you a bit.


BSSID: 9c:d2:1e
ESSID: DDW3659B
KEY: DDW365F3169B

BSSID: 00:1d:cf
ESSID: TG852GF2
KEY: TG852GA1E3F2

BSSID: bc:85:56
ESSID: DDW36113A
KEY: DDW361180523A

BSSID: 68:94:23
ESSID: DDW3611A2
KEY: DDW3611B92FA2

BSSID: E4:D5:3D
ESSID: U10C02285
KEY: U10C022607E85

BSSID: 00:1D:D3
ESSID: DG860A42
KEY: DG860A862B42

BSSID: 0C:F8:93
ESSID: TG862G52
KEY: TG862GBC6D52

BSSID: 00:1D:D2
ESSID: TG862G62
KEY: TG862GBF8362

BSSID: 00:1D:D2
ESSID: TG862G42
KEY: TG862GBF5142

BSSID: 8C:04:FF
ESSID: DWG87518
KEY: DWG875F9AC18

BSSID: 9C:D2:1E
ESSID: DDW36573
KEY: DDW365F3B673

BSSID: 14:2D:27
ESSID: DDW3655B
KEY: DDW365DF2F5B

BSSID: 9C:D2:1E
ESSID: DDW3658B
KEY: DDW365F54C8B

BSSID: 1C:C6:3C
ESSID: SBG6580A2
KEY: SBG6580E630A2


Avatar
ExKage

Status: n/a
Joined: Tue, 28 Jul 2015
Posts: 153
Team:
Reputation: 88 Reputation
Offline
Sat, 01 Aug 2015 @ 21:33:31

BSSID: EC:22:80:11:B8:8C
WPS PIN: '11613565'
WPA PSK: 'B8A9A6MY'
AP SSID: 'TALKTALK-11B88C'

BSSID: 58:1F:28:06:C6:6C
WPS PIN: '16720114'
WPA PSK: 'DEXRATMV'
AP SSID: 'TALKTALK06C665'

BSSID: B8:A3:86:97:76:4A
WPS PIN: '99262181'
WPA PSK: 'QEC47RAP'
AP SSID: 'TALKTALK-97764A'

Hope this helps ! UK TALKTALK ROUTERS


Bitcoin - 16LwMPgzwuAuvYx2HzFPsDEb6b7T94bvi

Avatar
Lfptlost

Status: n/a
Joined: Fri, 04 Sep 2015
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Fri, 04 Sep 2015 @ 03:14:34

Any knows the defaults wps pin of this routers?
VM636030-2G mac:E8-FC-AF-24-C9-E0
SKY19E93 MAC :7C-4C-A5-DE-CA-29
VIRGINMEDIA2335976 MAC: A0-21-B7-E8-6F-26
VIRGINMEDIA1436558 MAC : A0-21-B7-E4-6D-4E

Thanks


Avatar
ExKage

Status: n/a
Joined: Tue, 28 Jul 2015
Posts: 153
Team:
Reputation: 88 Reputation
Offline
Fri, 04 Sep 2015 @ 08:00:50

Lfptlost said:

Any knows the defaults wps pin of this routers?
VM636030-2G mac:E8-FC-AF-24-C9-E0
SKY19E93 MAC :7C-4C-A5-DE-CA-29
VIRGINMEDIA2335976 MAC: A0-21-B7-E8-6F-26
VIRGINMEDIA1436558 MAC : A0-21-B7-E4-6D-4E

Thanks


Not the right thread but I will give the possible pins for those routers, it might not be ones but it's the possible pins.
VM636030-2G = 24109765
SKY19E93 = 46007452
VIRGINMEDIA2335976 = 52328060
VIRGINMEDIA1436558 = 49701906


Bitcoin - 16LwMPgzwuAuvYx2HzFPsDEb6b7T94bvi

Avatar
ExKage

Status: n/a
Joined: Tue, 28 Jul 2015
Posts: 153
Team:
Reputation: 88 Reputation
Offline
Fri, 04 Sep 2015 @ 13:40:22

Philippine's Router/Wifi Router/Modem

PLDTXXXX
PLDTWIFIXXXX
PLDTHOMEDSLXXXX

ALL OF THOSE HAVE THE SAME ALGORITHM

Password is
PLDTWIFI(LAST 5 DIGITS OF MAC ADDRESS)

SO lets say this is the wifi
PLDTWIFI3415
MAC : 00:11:26:59:62:51

The default password will be "PLDTWIFI96251"

and it is VERY VULNERABLE to WPS ATTACKS, PIXIEWPS is super effective on PLDTWIFI ROUTERS in the Philippines

Hope that helps


Bitcoin - 16LwMPgzwuAuvYx2HzFPsDEb6b7T94bvi

Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Fri, 04 Sep 2015 @ 14:46:07

Thank you ExKage, have some +Rep


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
ExKage

Status: n/a
Joined: Tue, 28 Jul 2015
Posts: 153
Team:
Reputation: 88 Reputation
Offline
Fri, 04 Sep 2015 @ 18:13:26

Hash-IT said:

Thank you ExKage, have some +Rep

No worries Just interesting the way how hashcat works, I just sit here and look at it and it just blows my mind xD
Although I only 48,000+ k/s to crack a WPA password
I still try.


Just might to let you know, that PLDTWIFI Router in the Philippines can be cracked with a rooted android phone with an App called Wps Wpa2 Tester, basically it finds the possible pins for the routers it scans. Confirmed it with my friend in the Philippines, saying every PLDTRouter are vulnerable to the attack.


Bitcoin - 16LwMPgzwuAuvYx2HzFPsDEb6b7T94bvi

Avatar
blandyuk
Admin / Owner
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3214
Team: HashKiller
Reputation: 4165 Reputation
Offline
Fri, 04 Sep 2015 @ 18:57:45

Nice but I already owned these routers in Cebu in Jan 2014

https://forum.hashkiller.co.uk/topic-view.aspx?t=5134

Nice to know someone else found this vulnerability.


Please read the forum rules | Please read the paid section rules
I accept private hash lists, with forum donations only.
BTC: 1JZGVq58m4RS1QQS8JE5xndzDFy2BvGU6y
GPU Power: 9x GTX 1070 + 6x GTX 1080

Avatar
ExKage

Status: n/a
Joined: Tue, 28 Jul 2015
Posts: 153
Team:
Reputation: 88 Reputation
Offline
Fri, 04 Sep 2015 @ 19:55:25

blandyuk said:

Nice but I already owned these routers in Cebu in Jan 2014

https://forum.hashkiller.co.uk/topic-view.aspx?t=5134

Nice to know someone else found this vulnerability.


Yeah, I grew up in the Northern Cebu and moved to England due to my dad's health. But ofcourse you probably know this, Northern cebu is almost all mountains and hills and not a lot of technology evolved in that place. Me and my brother and dad used to send a wifi signal 10km away using a transceiver in a hill between my house and the destination. It's quite shocking to know how technology can stretch farther and farther. Yeah 10Kilometers XD we were sending DIAL UP CONNECTION SPEED to one of my dad's friend. Imagine that! Dial Up connection Hah! :P


Bitcoin - 16LwMPgzwuAuvYx2HzFPsDEb6b7T94bvi

Avatar
bymert1903

Status: n/a
Joined: Sun, 06 Sep 2015
Posts: 22
Team:
Reputation: -10 Reputation
Offline
Sun, 06 Sep 2015 @ 02:25:54

A4:99:47:A4:CC:E8 = TTNET_HUAWEI_CCE2



409 Results - Page 3 of 14 -
1 2 3 4 5 6 7 8 9 10 11 12 13 14

We have a total of 197675 messages in 24450 topics.
We have a total of 21731 registered users.
Our newest registered member is Jxchem.