Wordlists??? - AT&T U-Verse and Charter Cable

[combat]

I think at least some of us know that AT&T uses a simple 10 digit numeric password for their U-Verse routers, does anyone have a wordlist for this that works well?

I have also had Charter Cable service before and I have had their service before (still have the modem actually) - is there a wordlist for this also??

[Diesel92]

The 10 digits from ATT are mostly phone numbers of the client, so you can use crunch in aircrack to brute-force the password, or you can generate the wordlist from 1000000000-9999999999 using crunch, but that would create a very big wordlist (>100 GB). A better solution is using oclHashcat and learn to use mask attack, so you can narrow down the success chance (For example: you can put in your area code as a known mask, thus you only have 7 more numbers to brute force and save you a lot of time). Another advantage is mask attack doesn't create wordlist, so this will save you some space on hard drive. About Charter wordlist, Charter is using the same default pass of their router manufacture, which is Netgear. So you can just use NetgearXX wordlist, which is available here in the forum, you just have to search for it.

[TheMantis]

I think at least some of us know that AT&T uses a simple 10 digit numeric password for their U-Verse routers, does anyone have a wordlist for this that works well?

I have also had Charter Cable service before and I have had their service before (still have the modem actually) - is there a wordlist for this also??

you can use CRUNCH to create your own 10 digit numeric wordlist.

[combat]

you can use CRUNCH to create your own 10 digit numeric wordlist.

Working on it now, 106GB....it took me a while to get it to output what I was wanting exactly. I was having trouble with it for a little while so I thought maybe it would be easier to just download one.

[TheMantis]

you can use crunch a pipe it to aircrack-ng if you like.
crunch 10 10 1234567890 | aircrack-ng -b AP_MAC -w - *.cap

[mmusket33]

Ref Diesel92 comments

"you can narrow down the success chance (For example: you can put in your area code as a known mask"

MTeams agrees and provides the following expansion:

To implement this suggestion use the following command line:

crunch 10 10 1234567890 -t 123@@@@@@@ | aircrack-ng -b AP_MAC -w - *.cap

Where your area code is 123.

or another way

crunch 10 10 -f /usr/share/crunch/charset.lst numeric -t 123@@@@@@@ | aircrack-ng -b AP_MAC -w - *.cap

Where -f is the path to the Crunch Character list.

In either case you only need to check a 7 character variable string which can easily be done by even slow computers.

If the key is not found then run the entire 10 length string:

crunch 10 10 1234567890 | aircrack-ng -b AP_MAC -w - *.cap

or

crunch 10 10 -f /usr/share/crunch/charset.lst numeric | aircrack-ng -b AP_MAC -w - *.cap

When running character strings lengths 8,9 and 10 it is best to precompute the files. When doing a passthru the crack speed is reduced as part of the computers resources are needed to first compute the variable with crunch. Greater then 10 characters and a precomputed file size becomes rather large leaving only passthru as a option.

For those that really want to crack WPA thru brute force though, we suggest elcomsoft(windows 7 or 8) and two higher end video cards.

For more on crunch see Crunch A Day With Tape. An excellant overview of crunch can be found there. You can learn how to stop and restart the attack and divide your files into smaller sizes.

Musket Teams