Default WiFi Router Keyspace

The passwords that come default on wireless routers may seem secure, a bunch of random letters and numbers. But all is not as it seems, for whatever reason many ISPs restrict the keyspace of the passwords that come on their routers. For example in the UK, once you sign a contract for broadband with BT you will get sent a BT homehub router with a default password that looks totally random, however that password will actually only contain numbers 2-9 and letters a-f and will always be 10 characters long, armed with this information cracking a wpa2 key becomes a lot easier and a lot faster. In the above video I explain all. Down below is a list of default router password keyspaces I have collated.

BTHomeHub-XXXX - [0-9a-f] Len: 10
BTHomeHub2-XXXX - [2-9a-f] Len: 10
BTHub3 - [2-9a-f] Len: 10
BTHub4 - [2-9a-f] Len: 10
BTHub5 - [2-9a-f] Len: 10
BTHub6 - [0-9a-zA-Z] Len: 10 or 12
ThomsonXXXXXX - [0-9a-f] Len: 10
PlusnetWireless-XXXXXX - [0-9A-F] Len: 10
belkin.xxx - [2-9a-f] Len: 8
belkin.xxxx - [2-9a-f] Len: 8
Belkin.XXXX - [0-9A-F] Len: 8
Belkin_XXXXXX - [0-9A-F] Len: 8
BELL### - [0-9A-F] Len: 8
BELL#### - [0-9A-F] Len: 10
TP-LINK_###### - [0-9A-F] Len: 8
TDC-#### - [0-9a-f] Len: 9
TNCAPXXXXXX - [0-9A-F] Len: 10
WLAN1-XXXXXX - [0-9A-F] Len: 11
TelstraXXXXXX - [0-9A-F] Len:10
BigPondXXXXXX - [0-9A-F] Len:10
2WIREXXX - [0-9] Len: 10
ONOXXXX - [0-9] Len: 10
DJAWEB_##### - [0-9] Len: 10
TIM_PN51T_XXXX - [0-9] Len: 8 - WPS pin is 12345670... and WPS can't be disabled...
INFINITUM#### - [0-9] Len: 10
NETGEARXX - Adjective + Noun + 3 Digits
CenturyLinkXXXX - [0-9a-f] Len: 14
BrightBox-XXXXXX - [??] Len: 8
EEBrightBox-XXXXXX - [3 word with hyphens]
Orange-XXXX - [2345679ACEF] Len: 8
TALKTALK-XXXXXX - [ABCDEFGHJKMNPQRTUVWXY346789] Len: 8
AOLBB-XXXXXX - [0-9A-Z] Len: 8
UPCXXXXXXX - [A-Z] Len: 8
SKYXXXXX - [A-Z] Len: 8
Tech_XXXXXXXX - [A-Z] Len: 8
Keenetic-XXXX - [a-zA-Z0-9] Len: 8 (Might be scope to reduce the charset but even so, large key-space)
Virgin Media [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX-2G [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX-5G [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX [0-9a-zA-Z] Len: 12
FRITZ!Box Fon WLAN #### - [0-9] Len: 16
EasyBox-###### - [0-9A-F] Len: 9
MobileWifi-xxxx - [0-9] Len: 8
3Wireless-Modem-XXXX - [0-9A-F]
UNITE-XXXX - [0-9] Len: 8
Verizon MIFIXXXX XXXX - [0-9] Len: 11
VirginMobile MiFiXXXX XXX - [0-9] Len: 11
E583x-xxxx - [0-9] Len: 8
E583x-xxxxx - [0-9A-F] Len: 8
Domino-XXXX - [0-9A-F] Len: 8
Netia-XXXXXX - [0-9a-f] Len: 13
Telecom-XXXXXXXX - [not-sure]

If what you’re looking for isn’t here then try googling it or check this post which is where this list came from.

Leave a Reply