TRENDnet WPA disclosure & dictionaries for attack
Previously disclosed in WiFi-libre
* Fulldisclosure WPA TRENDnet
* Diccionarios para routers TRENDnet
Hi guys!
I wanted to share with you this disclosure about TRENDnet routers i have been working on.
So...
... Let's have a look to the default WPA key of a TRENDnet router :
As you can see the default key is 11 digits long.
- The three first digits are the numbers used in the model name.
If the model is "TEW-818DRU"; than the WPA passphrase will start with 818
If the model is a TEW-815DAP, than the 3 first digits of the passphrase will be 815
... and so on...- The 8 last digits are the same than the 8 last digits of the serial number
In the end of the serial two digits are always the same according to the model (position 2 and 3 in the srting)
At the end we have 6 unknowns digits remaining.
This 6 unknown digits are numbers
That gives us one million possible WPA passphase,
Something that you can be brute forced in a few minutes with any kind of hardware
The default essid contains the name of the model,
So if the default ssid is in use an attacker would recover the WPA key nearly instantanly
If the essid has been changed he would need to spend some more time, but not so much :
By checking the maximum transmission rate in the probes he would already limit himself to something like 4-5 dictionaries to try.
This a little collection of dictionaries for TRENDnet.
They are zipped, you just need to unzip them.
Once you unzipped them their weight is a little more than 10 MB.
I give you also "the formula" for every dictionary .
All downloads are direct link without advertisement (account google drive)
TEW-828DRU (ac 3200)
formula : 828XRGXXXXX ( X are numbers )
download : TEW-828DRU
TEW-823DRU (ac 1750)
formula : 823X23XXXXX ( X are numbers )
download : TEW-823DRU
TEW-820DAP (ac 1750)
formula : 820X20XXXXX ( X are numbers )
download : TEW-820DAP
TEW-818DRU (ac 1900)
formula : 818XRGXXXXX ( X are numbers )
download : TEW-818DRU
TEW-815DAP (ac 1750)
formula : 815XACXXXXX ( X are numbers )
download : TEW-815DAP
TEW-813DRU (ac 1200)
formula : GXXXRXXX ( X are numbers )
download : TEW-813DRU
TEW-812DRU (ac 1750)
formula : 812XRDXXXXX ( X are numbers )
download : TEW-812DRU
TEW-811DRU (ac 1200)
formula : 811XREXXXXX ( X are numbers )
download : TEW-811DRU
TEW-753DAP (n 600)
formula : 753X7DXXXXX ( X are numbers )
download : TEW-753DAP
TEW-752DRU (n 600)
formula : 752RDXXXXXX ( X are numbers )
download : TEW-752DRU
TEW-751DR (n 600)
formula : 751RDXXXXXX ( X are numbers )
download : TEW-751RD
TEW-750DAP (n 600)
formula : 750RDXXXXXX ( X are numbers )
download : TEW-750DAP
TEW-735AP (n 300)
formula : 735X7AXXXXX ( X are numbers )
download : TEW-735AP
TEW-733GR (n 300)
formula : 733RNXXXXXX ( X are numbers )
download : TEW-733GR
TEW-732BR (n 300)
formula : 732X32XXXXX ( X are numbers )
download : TEW-732BR
I couldn't get data for absolutely all the models , so if you have any datas, please share them.
Take care && Enjoy!
