• MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>   
      SSID Passwords follow <word><number><word><number><word> format (ex: met8sonata868elm)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: stubble16crowded)
  
• MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9> 
      SSID Passwords follow <word><number><word><number><word> format (ex: moat288nit48pug)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: chopper86notably)
  
• MAC address starting with 3C.BD.C5 are the newest and have 15 character passwords
      SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>
               or Verizon_XXXXXX where X is any char <A-Z><0-9>     
      SSID Passwords for “Fios” networks follow <word><number><word><number><word> format (ex: range36vex77toy)
               or “Verizon” networks follow <word>-<word>-<word> with a single digit at the end of one word (ex: miry9-elm-north)
  
•     Admin Passwords for “Fios” network are 16 characters and follow a <word><number><word> format (ex: unusual53smelter)
              or “Verizon” networks are 9 characters that are <A-Z><0-9> (ex: Z79KGSX4T)
              Note: 0 and 1 are not seen in sample    
  

• MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
      SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>   
      SSID Passwords follow <word><number><word><number><word> format (ex: nylon88wit657aye)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: ritual236auction)
  
• MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
      SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>
      SSID Passwords follow <word><number><word><number><word> format (ex: mach92see36flat)
      Admin Passwords are 16 characters and follow a <word><number><word> format (ex: seraph497lantern)
  
• MAC address starting with 3C.BD.C5 have 15 character passwords
      SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
      SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: tenth-ben6-vend)    
      Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: 3JB94H6CQ)        
      Note: 0 and 1 are not seen in sample  
  
• MAC address starting with DC.F5.1B are the newest and have 15 character passwords
      SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
      SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: plush-fast3-con)    
      Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: QVB734TKL)           
      Note: 0 and 1 are not seen in sample  
  

• Password <word> are between 3-7 characters for SSID Password
  
• Password <number> are between 1-4 digits
  
• There are 3 HW version (1102, 1103, 1104)
  
• Serial #’s are 16 digits (except for the most recent E3200 which have 11)
  
• Shipped firmware ranges from 1.3.5.1 to 3.1.1.16 
  
• There are the 568 unique words extracted from the passwords:
  

• Analyze the data set to try to reduce key space (unused characters, common words, find the wordlist?)
  
• Collect more complete entries for the dataset
  
• Try to mount file system (ubi.img) in a proper Linux environment
  
• Try to find older firmware
  

Quote:…Make one hashcat invocation able to find passwords for hashes of any version of PDF file, including owner as well as user password. Also, make an improved hash format which a) can describe hashes for any version of PDF file, b) can include a filename and path of the PDF document described by each hash, which may need to be c) a structured format like JSON or bencode rather than the current asterisk-separated flat file format, with d) clear documentation of the hash format, and e) an official, reliable pdf-to-hash tool.…

• Active state-based attack engine used to retrieve relevent EAPOL messages from Access Points and clients.
  
• Target option that accepts MAC (aabbcc..., aa:bb:cc...) and SSID "Test_SSID" to limit attack scope.
  
• Whitelist option to protect specific networks from attacks. Useful if not using targets.
  
• Auto Hunt capability to find all target channels and hop between them.
  
• A Terminal-UI that presents all relevent data while still living in the terminal for easy usage over SSH.
  
• Limits DEAUTHENTICATION frames that can cause more damage than good to the authentication sequence.
  
• EAPOL 4-Way-Handshake validation using Nonce Correction, Replay Counter validation, and Temporal validation.
  
• Automatically elicits PMKID from access points where available.
  
• Utilizes GPSD with ability to set remote GPSD service address.
  
• Provides pcapng files with embedded GPS using the Kismet Format.
  
• Provides a kismetdb file with all frames (with GPS) for post-processing.
  
• Wraps all output files in a gzipped tarball.
  
• Bash autocompletions for easy interface selection provided.
  

• Attempts authentication/association sequence to produce EAPOL Message 1 (PMKID Collection)
  
• Attempts to retrieve hidden SSID's with undirected probe requests.
  
• Utilizes Anonymous Reassociation to force Access Points to deauthenticate their own clients (MFP Bypass)
  
• Will attempt to send Channel Switch Announcement to send clients to adjacent channels.
  
• Attempts to downgrade RSN modes to WPA2-CCMP (Probe Response Injection)
  
• Attempts to collect EAPOL M2 from stations based solely on Probe Requests (Rogue AP)
  
• Will send controlled deauthentication frames unless told not to (--nodeauth)