NEW: We have a Discord server now. Click here to go there now!

NOTE: Why not use our List Manager to crack your lists? Its easy and enables better management.

NOTE: When cracking WPA/WPA2 passwords, make sure you check gpuhash.me first incase it's already been processed.

Home - Wireless Cracking - Default Router WPA Keys - Keyspace Used


409 Results - Page 4 of 14 -
1 2 3 4 5 6 7 8 9 10 11 12 13 14
Author Message
Avatar
whyso

Status: n/a
Joined: Thu, 17 Sep 2015
Posts: 14
Team:
Reputation: 0 Reputation
Offline
Thu, 17 Sep 2015 @ 20:43:52

is there a default key for hitron router? thanks.


Avatar
cvsi
Moderator
Status: Trusted
Joined: Fri, 23 May 2014
Posts: 2474
Team:
Reputation: 3618 Reputation
Offline
Thu, 17 Sep 2015 @ 20:57:42

I don't think we have anything here for the Hitron routers. But supposedly they are
vulnerable to the pixiewps attack, which is supposed to give you the key.


Please read the forum rules. | Please read the paid section rules.

GTX 1080 Ti , GTX 1080 , 1070 Ti , 2x GTX 1070 Everything watercooled

BTC - 3CwoAwqYgNSZpzzZ2FEjXYceXR2Wr2wTtD
ETH - 0x47D0A7cDA8b330b1729e554BCa5574dc60c51b1f

Avatar
whyso

Status: n/a
Joined: Thu, 17 Sep 2015
Posts: 14
Team:
Reputation: 0 Reputation
Offline
Fri, 18 Sep 2015 @ 10:13:49

cvsi said:

I don't think we have anything here for the Hitron routers. But supposedly they are
vulnerable to the pixiewps attack, which is supposed to give you the key.

well WPS is not enabled, so no luck with pixiewps attack or reaver.
Cannot crack with a dictionary as the the dictionary does not have the pass key, and i have tried with a 13GB dictionary file. no luck.
any other method that i can give a try?

Thanks
whyso


Avatar
karlb

Status: n/a
Joined: Sun, 19 Jan 2014
Posts: 3
Team:
Reputation: 0 Reputation
Offline
Thu, 01 Oct 2015 @ 13:23:06

A hard one from EE osprey MYWIFI mobile routers The wpa pass word is MYWIFI and four digits, The last four of the IMEI i.e MYWIFI1234 and the ssid is the last four characters of the mac address i.e MY WIFI AB12


Avatar
dastardlyman

Status: n/a
Joined: Tue, 03 Nov 2015
Posts: 3
Team:
Reputation: 0 Reputation
Offline
Tue, 03 Nov 2015 @ 23:25:10

please find attached a jpg of the networks i have been allowed to test
on over the years. ( i wasnt going to type it all in here!)
you will see it includes the ssids and wpa keys of various UK routers.
the information in it just confirms all the patterns that you have all spotted already.
you will notice that ive had great success with dumpper against my friend's talktalk routers.
dumpper even worked in France - but that info is not attached.

pixie-dust suprised me - there is life in wps yet.

keep up the great work everybody.

Your Man In Manchester.

PS - a slow reaver attack is NEVER going to work against a BThub5 ?right? or wrong?
thank you for any help with that question.



8 Core Athlon Dual Radeon 7870. approx 200K wpa/sec

Attachments: Login to view attachments.
Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Wed, 04 Nov 2015 @ 02:14:06

dastardlyman said:


PS - a slow reaver attack is NEVER going to work against a BThub5 ?right? or wrong?
thank you for any help with that question.

I have never had any success with Reaver on any BT router.


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
dastardlyman

Status: n/a
Joined: Tue, 03 Nov 2015
Posts: 3
Team:
Reputation: 0 Reputation
Offline
Wed, 04 Nov 2015 @ 17:09:58

many thanks.
:-)
i will get a handshake and start my radeons off . . .


8 Core Athlon Dual Radeon 7870. approx 200K wpa/sec

Avatar
Eleadon

Status: n/a
Joined: Wed, 11 Nov 2015
Posts: 23
Team:
Reputation: 52 Reputation
Offline
Fri, 13 Nov 2015 @ 05:11:36

This is a great ongoing list. I have two more to contribute...

TELUSXXXX - [0-9a-f] Len: 10
http://s30.postimg.org/voy6tsu7l/telus.jpg

Hitron - [0-9A-Z] Len: 12 (equal to the device's serial number)
http://s16.postimg.org/5u8uyj211/hitron.jpg

Certain Hitron's are known to use the device's serial number as their default key. The one's I've seen are 12-characters long, begin with a 24 or 25, have a 1 as the 4th character and have a 0 as the 7th character. So you could try a mask which looks like this (if you're lucky and it's numeric only)...

oclHashcat64 -m 2500 cap.hccap -a3 -1 "45" 2?1?d1?d?d0?d?d?d?d?d

Personally I find the easiest way to keep track of all of these is to create empty folders named after networks and their default keyspaces. That way I can easily see at a glance what networks use what. Rather than creating all of these folders manually I've written a small dos batch script that will do it for you. You can download it here...

https://github.com/wpatoolkit/Default-Keyspace-List

If an algorithm or tool exists for a particular network a small .txt file is also created inside that network's folder with links to more information.


BTC: 1JAxmj4n2pTskkK37h1pysYd2L5XjXsM3W

Avatar
wifiwifi

Status: n/a
Joined: Mon, 16 Nov 2015
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Mon, 16 Nov 2015 @ 19:58:05

Hi friends,
I do not manage to obtein the pass of any of these SKY networks:

ESSID: SKY9631A
BSSID: C0:3E:0F:9A:19:B1


ESSID: SKY29F7C
BSSID: C8:3A:35:F7:84:00

I hope someone in the forum be capable of cracking any of these.
I attack the package contenor of the password of them.
Regards!

https://www.dropbox.com/s/c0xj078fghnajxn/SKY9631A.cap?dl=0

https://www.dropbox.com/s/ni7aix3vc5hrmjx/SKYFTC.cap?dl=0


Avatar
core2lee

Status: n/a
Joined: Sun, 22 Nov 2015
Posts: 10
Team:
Reputation: 0 Reputation
Offline
Sun, 22 Nov 2015 @ 05:33:45

I'm also stuck with a Sky Router :'( I REALLY need a fast GPU in my life. The info in this post is gold dust btw, saves loads of time knowing formats of various Routers. The best I can manage is ~3500 H/s on an i7 Macbook but not that's still gonna take ~80 days to crack


To try to contribute to this, Plusnet have just release a rebranded HH5 (Sagemcom) Router, couple of examples;

SSID: PLUSNET-NK6C
WPA2: d39ac6c23f
MAC: A0:1B:29:66:61:D6
Admin Pass: JF3974N4

SSID: PLUSNET-8K5M
WPA2: e968a684bc
MAC: A0:1B:29:66:57:40
Admin Pass: EJPF4HEK

If anyone thinks they can grab the pass of this Sky handshake it would be much appreciated as I just do not have the computing power;
https://www.mediafire.com/folder/rz8qix8zlu6ja/Fecking-SkyRouter


Avatar
Illyria

Status: n/a
Joined: Sat, 17 Oct 2015
Posts: 98
Team:
Reputation: 259 Reputation
Offline
Sat, 05 Dec 2015 @ 13:11:16

Gateway/Router: Cisco EPC3925 - http://s15.postimg.org/fchccjxjv/epc3925.png

ISP: Stofa (Danish Cable TV/Internet provider)
SSID (example): liter52rubin79artig - all SSID matches the 5l-2d-5l-2d-5l pattern
Default WPA2: df8669af5de3d40e69524c8b44 - [a-f0-9]{26}


Little chance anyone will bruteforce it. On the plus side, very few are going to keep the default pass


GTX950 x1
BTC 13qqKvfiZDQEkQtAfPNNCYuReC7M4Rwfdu

Avatar
NorbertUk

Status: n/a
Joined: Sat, 05 Dec 2015
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Sat, 05 Dec 2015 @ 15:01:40

I've had a ZyXEL router and it had 10 characters only, instead of 13.Also A-F, not to Z.
ZyXELXXXXXX - [0-9A-F] Length 10
My DEFAULT password was like this: 95B12E4C6F


Avatar
Hash-IT

Status: Trusted
Joined: Tue, 02 Aug 2011
Posts: 4598
Team: HashKiller
Reputation: 2982 Reputation
Offline
Sat, 05 Dec 2015 @ 15:32:03

Illyria and NorbertUk, thanks to both of you for the updates.


Please read the forum rules. | Please read the paid section rules.

BTC: 1MmWESN5bKZ1YSuHrm5uNwnQYxWyQnEQ6E

Avatar
cvsi
Moderator
Status: Trusted
Joined: Fri, 23 May 2014
Posts: 2474
Team:
Reputation: 3618 Reputation
Offline
Sat, 05 Dec 2015 @ 15:51:37

I was just browsing through random router pics on google yesterday. Saw this one.


BOLT!SUPER 4G-XXXX [0-9A-F] Length 8 Last 4 of Passhprase = Last 4 of SSID


I have never seen the AP before, and don't know how many are out there. The one pic I saw of it was
The last 4 char of the SSID was also the last 4 char of the Pass.


Please read the forum rules. | Please read the paid section rules.

GTX 1080 Ti , GTX 1080 , 1070 Ti , 2x GTX 1070 Everything watercooled

BTC - 3CwoAwqYgNSZpzzZ2FEjXYceXR2Wr2wTtD
ETH - 0x47D0A7cDA8b330b1729e554BCa5574dc60c51b1f

Avatar
soxrok2212

Status: Cracker
Joined: Sat, 24 Oct 2015
Posts: 455
Team:
Reputation: 421 Reputation
Offline
Sat, 05 Dec 2015 @ 17:04:07

There are also various TP-Link devices using 8 numbers and not hex. I also believe they are the same as the WPS pin but I haven't tested. Confirmed on 2 devices.

TP-LINK_2.4GHz_XXXXXX [0-9] Length 8
TP-LINK_5GHz_XXXXX [0-9] Length 8
TP-LINK_XXXXXX [0-9] Length 8



BTC: 1B4ZAbWYQ399p6QJm3VLbywiCWVSBAXYJ1

NVIDIA
1x GTX 1080 Founder’s Edition
1x GTX 980 Reference Design

Avatar
cvsi
Moderator
Status: Trusted
Joined: Fri, 23 May 2014
Posts: 2474
Team:
Reputation: 3618 Reputation
Offline
Sat, 05 Dec 2015 @ 17:12:06

PLUSNET-XXXXXX 0-9 a-f Length 10


Please read the forum rules. | Please read the paid section rules.

GTX 1080 Ti , GTX 1080 , 1070 Ti , 2x GTX 1070 Everything watercooled

BTC - 3CwoAwqYgNSZpzzZ2FEjXYceXR2Wr2wTtD
ETH - 0x47D0A7cDA8b330b1729e554BCa5574dc60c51b1f

Avatar
MadPierre

Status: n/a
Joined: Tue, 30 Sep 2014
Posts: 14
Team:
Reputation: 0 Reputation
Offline
Wed, 09 Dec 2015 @ 21:15:54

69:7A:2C

E9A64C6U


Uk - TalkTalk Router


Avatar
zangets

Status: n/a
Joined: Mon, 28 Dec 2015
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Mon, 28 Dec 2015 @ 19:53:32

HI are u interested in moroccan router
provider = itissalat el maghrib

network name = TNCA9425D7
and also
network name = Thomson65979C

thnx u so much for help


Avatar
ElDavo

Status: n/a
Joined: Sat, 27 Dec 2014
Posts: 36
Team:
Reputation: 0 Reputation
Offline
Wed, 30 Dec 2015 @ 15:12:19

Hi, I don't login here from about one year...
However:
Linkem_XXXXXX might be [0-9] Lenght 8 , but i'm Not sure
That's Not 12345678
Vodafone_XXXXXXXX (Italy, X is a number) is [0-9,a-z] Lenght 15.
Alice_XXXXXXXX (again, x is number) is [0-9,a-z] lenght 24 but broken algo for some old models
Digicom_XXXX [0-9,A-Z] lenght 8
Sitecom_XXXX [0-9,A-F] lenght 8 but broken wps pin algo
That's all


Avatar
ankh2054

Status: n/a
Joined: Mon, 04 Jan 2016
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Mon, 04 Jan 2016 @ 12:22:02

wifiwifi said:

Hi friends,
I do not manage to obtein the pass of any of these SKY networks:

ESSID: SKY9631A
BSSID: C0:3E:0F:9A:19:B1


ESSID: SKY29F7C
BSSID: C8:3A:35:F7:84:00

I hope someone in the forum be capable of cracking any of these.
I attack the package contenor of the password of them.
Regards!

https://www.dropbox.com/s/c0xj078fghnajxn/SKY9631A.cap?dl=0

https://www.dropbox.com/s/ni7aix3vc5hrmjx/SKYFTC.cap?dl=0

Ill give it a go, I'm using the following assumptions:

  • 8 characters Uppercase
  • No sequential letters ( this could be wrong but greatly reduces the time required)
  • First character starts with HEWICULFBSPGQMRXZVTNKYADOJ


I'm very very new to all of this, but learning


As a note all the SKY WOPA's I've looked at never have sequential characters. I've looked at 20 WPA KEYs, so not definitive but worth looking into



Avatar
ziggycat

Status: n/a
Joined: Wed, 18 Mar 2015
Posts: 48
Team:
Reputation: 42 Reputation
Offline
Tue, 12 Jan 2016 @ 22:24:20

Just come accross this..

https://haxx.in/upc-wifi/

Not sure if it's legit or not but if anyone has a UPC technicolor router they have cracked then please test it and let us know the result


Avatar
jugganuts420

Status: Member
Joined: Sat, 21 Feb 2015
Posts: 318
Team:
Reputation: 317 Reputation
Offline
Sun, 17 Jan 2016 @ 19:56:38

Ok so iv been roaming the states and have come across routers by the ISP Frontier with SSID's of

Frontier?d?d?d?d

come to find out ALL of them use 10 digits phone numbers as there default passwords

iv uploaded the cap and hccap of one with more to come i a lil bit to confirm my statement

for this AP the password is

Frontier3818:4c60dea7b228:c4731e268854:5075282444


+rep if i helped :)

Attachments: Login to view attachments.
Avatar
The_Mechanic

Status: Trusted
Joined: Sun, 07 Oct 2012
Posts: 401
Team:
Reputation: 651 Reputation
Offline
Sat, 30 Jan 2016 @ 20:17:53

jugganuts420 said:

Ok so iv been roaming the states and have come across routers by the ISP Frontier with SSID's of

Frontier?d?d?d?d

come to find out ALL of them use 10 digits phone numbers as there default passwords

iv uploaded the cap and hccap of one with more to come i a lil bit to confirm my statement

for this AP the password is

Frontier3818:4c60dea7b228:c4731e268854:5075282444

Can say for a fact, No they all don't Ap brodcasts the same format but depends on the model of router ,mac address is different, another type has Modem Default of 16 length Upper + Digits and WPS disabled, guest accnt is disabled but if guest account is active that default is length 8 upper lower digits


Avatar
agent__7

Status: n/a
Joined: Sun, 31 Jan 2016
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Sun, 31 Jan 2016 @ 19:37:18

ziggycat said:

Just come accross this..

https://haxx.in/upc-wifi/

Not sure if it's legit or not but if anyone has a UPC technicolor router they have cracked then please test it and let us know the result

I can confirm it works.

Can someone give a few hints on the hash for UPCXXXXXXXXX (UPC%09d)?

Thanks,


Avatar
$sh

Status: n/a
Joined: Mon, 01 Feb 2016
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Mon, 01 Feb 2016 @ 16:19:27

Do you know if Netgear routers with SSIDS NETGEAR or Netgear follow the same algorithms as NETGEARXX routers?
I live in Germany and I have only found these yet.


Avatar
john8596

Status: n/a
Joined: Sat, 06 Feb 2016
Posts: 3
Team:
Reputation: 0 Reputation
Offline
Tue, 09 Feb 2016 @ 01:17:35

Can anyone crack the following routher WPA for me:

VM840042-2G

Offering £15


Avatar
cvsi
Moderator
Status: Trusted
Joined: Fri, 23 May 2014
Posts: 2474
Team:
Reputation: 3618 Reputation
Offline
Tue, 09 Feb 2016 @ 01:20:34

john8596 said:

Can anyone crack the following routher WPA for me:

VM840042-2G

Offering £15


If you want to have something cracked for pay. It needs to be posted in the paid section.
You will also need a handshake. .cap file.


Please read the forum rules. | Please read the paid section rules.

GTX 1080 Ti , GTX 1080 , 1070 Ti , 2x GTX 1070 Everything watercooled

BTC - 3CwoAwqYgNSZpzzZ2FEjXYceXR2Wr2wTtD
ETH - 0x47D0A7cDA8b330b1729e554BCa5574dc60c51b1f

Avatar
ElDavo

Status: n/a
Joined: Sat, 27 Dec 2014
Posts: 36
Team:
Reputation: 0 Reputation
Offline
Thu, 11 Feb 2016 @ 22:48:27

So, here we are with the definitive infos about Linkem!
The new Linkem routers, which use LTE, can be F8:35:DD:XX:XX:XX (ESSID = Linkem_XXXX(X+2).
Example:
BSSID F8:35:DD:D2:3A:E5
ESSID Linkem_D23AE7
or, rarely, 1C:49:7B:XX:XX:XX , ESSID is Linkem_XXXXX
WPA is 8 alphanumeric lower. (d3np4kd2)

Now here comes the sun :8
There are a few older models, they are very rare because they use Wi-Max, but their default WPA is..... 12345678 !
Their BSSID is 0C:4C:39:XX:XX:XX and their ESSID is Linkem-XXX(X+1) (like before)

I hope everyone understood everything, if not simply ask me :8 Please update the first post, bye


Avatar
cheeseuk1989

Status: n/a
Joined: Sun, 03 May 2015
Posts: 39
Team:
Reputation: 10 Reputation
Offline
Sat, 12 Mar 2016 @ 23:36:34

VodafoneConnect
WPA2 f879pc6u9kxwvpv



Avatar
cheeseuk1989

Status: n/a
Joined: Sun, 03 May 2015
Posts: 39
Team:
Reputation: 10 Reputation
Offline
Sun, 13 Mar 2016 @ 02:31:18

3MobileWiFi "MiFi's"
WPA2 8dtd98ma
http://funkyimg.com/i/295KP.png (Too large to post on forum)

Also my spare MiFi WPA2 is 40hgtn2t



409 Results - Page 4 of 14 -
1 2 3 4 5 6 7 8 9 10 11 12 13 14

We have a total of 197535 messages in 24435 topics.
We have a total of 21708 registered users.
Our newest registered member is dhiafd711.