Keyspace List for WPA on Default Routers

[soxrok2212]

FWIW, I found this link: http://www.dslreports.com/forum/r3146635...5-6-529454

Has firmwares for a lot of devices on it

Grabbed 589, 599, and 5268AC

vATT (video ssid) is generated from serial number... that's one mystery solved. This very well could be the key to the rest of the mystery!

Code:

#!/bin/sh

# Generate a unique video SSID from the box's serial number

charset="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!\"#\$%&'()*+,-./:;<=>?@[]_\`{|}~\\"

cat /sys/module/board/parameters/serialnumber | openssl sha1 | awk '
{
    hash = $2;

    sizeof_charset=split( chars, charset, "" );

    hex[0] = "0";
    hex[1] = "1";
    hex[2] = "2";
    hex[3] = "3";
    hex[4] = "4";
    hex[5] = "5";
    hex[6] = "6";
    hex[7] = "7";
    hex[8] = "8";
    hex[9] = "9";
    hex[10] = "a";
    hex[11] = "b";
    hex[12] = "c";
    hex[13] = "d";
    hex[14] = "e";
    hex[15] = "f";

    for(a=0; a<16; a++)
    {
        for(b=0; b<16; b++)
        {
            idx = 16*a + b;
            str = sprintf( "%s%s", hex[a], hex[b] );
            bighex[ str ] = idx;
        }
    }

    resultstr = "";

    for(i=1; i<= length(hash) && i <= 14; i += 2)
    {
        str = substr(hash, i, 2);
        idx = bighex[ str ];
        idx = idx % sizeof_charset;
        resultstr = resultstr charset[idx];
    }

    print "vATT" resultstr;
}' chars=$charset

Here is some data from an NVG599:

Code:

Serial: 233117095338288
WPA: xhq#aeeg3qte
SSID: ATT7sCun6a
MAC: D4:04:CD:A8:A1:31
Access Code: 07<0//9762 // might be 0 or O, not sure

Makes me wonder if they are at all related...