Best Apps for Hacking WiFi (iPhone / iPad / iTouch / Mac / Windows / Android / Nokia / Linux)

Security researchers have identified some wireless routers of having default passwords derived from a routers MAC address (e.g D8:3A:32:28:21:72) or SSID (network name). Read this to learn more. To determine what vendor the WiFi network is on, you can lookup the MAC address here or download the MAC address lookup app.

Now, If you are serious about security auditing and hacking WiFi, the iPhone is a poor choice of technology. Some of you might want to become advanced and improve your success rate with a good WiFi hacking long-range setup through your computer with Beini or BackTrack. However, it still is very possible with an iPhone and there are a number of freely available apps in Cydia (if you don't have your iDevice jailbroken, look in the right hand pane of this page and enter your iDevice information in the 'Jailbreak Wizard' to see how jailbreak) and iTunes that are able to recover these passwords. If you have Cydia, you should add BigBoss and xSellize repos and type in 'SSID' to get most of the apps listed below.



This will not work if the default password has been changed. My success rate of gaining entry into a compatible router is ~65%. The comparison table gives you an idea how the apps compare side-by-side:


Table 1: Best iDevice WiFi Hacking Apps


Name
Cost
Store
Offline
MAC Shown
Signal Strength
Network Scan
Connect in App
$8.19
Cydia
Yes
Yes
Yes
Yes
Yes
$1.99
iTunes
No
No
No
No
No
Free
Cydia
Yes
Yes
Yes
Yes
No
Free
Internet
No
No
No
No
No
$3.99
Cydia
No
No
No
No
No
$2.25
Cydia
No
No
No
No
No
$3.99
Cydia
No
No
No
No
No

* Can be downloaded for free via appcake or apptrackr, still requires a jailbreak, afc2add and AppSync from Cydia.

** Can be downloaded for free via xSellize repo in Cydia.
There are a few more available in iTunes, but they have an ugly GUI or in a foreign language:



Universal WPA Finder $0.99
WiFi WPA $1.99 
WPA Inspector $1.99  
HAG WPA Finder $0.99


You can also search the app store for any WiFi related app (if it is not showing to your right, temporarily disable adblock). Suggested search terms: wifi, wep, wpa, ssid, network.

iWep Pro
The developer over at iWazDev has created the best, feature packed and most expensive (or free if you decide to download it from a repo that hosts cracked apps) WiFi auditing tool out there. It is also the most difficult to setup as you are required to download 12 iWep Pro dictionaries in Cydia (2004 to 2011) for offline use.


Installation Instructions
If you do not want to spend the hefty price tag, you can download the latest 5.0.1 or 4.1.3 HERE


1. Dictionary Downloads (Download them all)


iWep PRO Dictionary for BTHomeHub Routers:
iWep PRO Dictionary for Thomson Based Routers:
Password to download the files is: dishingtech


New iWazowski Cydia Repo
There is a new temporary repo if the links above do not work: http://iwazowski.hostzi.com/repo/


Dictionaries are DEB files, and have to be installed just like all other DEBs (using iFile or via MobileTerminal / SSH) or downloading them from the iWazowski repo: http://iwazowski.com/repo/. They extract as speedSHA1dic files.


Check out the video below on how to install it or use the written instructions.


2. Upload the files to your device
First, you have to know where you want the .deb files (e.g /var/mobile/Media/Downloads) and upload the files on to your device. Best to use the easier method.



3. Install iWep Pro & Dictionaries


Easiest Method

  1. Install iFile from Cydia
  2. Download iFunboxCyberduck or iExplorer (or install afc2add and openSSH in Cydia)
  3. Download desired (.debs) files (if you haven't yet) to your desktop
  4. Run one of the apps and connect your iPhone, iPod or iPad usb cable
  5. The program will show your device contents, Now navigate to any folder for example: var/mobile/Documents (if you can't access the root directory, download afc2add in Cydia)
  6. Move (.deb) files from your desktop to var/mobile/Documents
  7. Run iFile from your iOS, and navigate to the same folder i.e. var/mobile/Documents
  8. Click on (.deb) file and select install one by one until you install all the required dictionaries
Alternative Installation Method

1. Start Cydia, go to 'Search', type 'Mobile Terminal' and install it (if you haven't yet). Be aware that there are different versions for different iOSs.
2. Repeat step 1 for 'OpenSSH'
3. Start 'MobileTerminal'
4. Type the following:
• su root  (press return)
• alpine  (press return)


Install iWep Pro and the Dictionaries through Mobile Terminal e.g. type:


dpkg -i /var/mobile/Media/Downloads/iWep Pro 4.1.3.deb (Note you can rename the.deb files e.g 1.deb which will make it quicker to install) and do that with the rest of the files you downloaded.


When you install the files and you Finish with Result Code 256 error message?

It means you made a mess of installations. You have previously tried to install the app. Basically it already exists and there’s a conflict, and hence dpkg throws you an error because it cannot rewrite it. 

How to fix? 
The best way to fix this problem is to completely uninstall and remove all previous instances of the app. That means uninstalling via Cydia and also going in and manually removing the app files if necessary from the iWep Pro folder. You could also try the following commands: dpkg --force-depends -i thenameofthefile.deb to install and dpkg --force-depends -r nameofpackage to remove.

If you finish with with Result Code 512 error message?
It means that the file/s are in use. Probably Cydia is running, try closing Cydia in the background and try installing again.

Try again and success means you end up with result code 0.


4. Open the App
Note: You must be connected to WiFi, 3G or EDGE to activate your licence. iPad and iTouch users will need WiFi or 3G.





Activating Your Licence in 4.1.3
1. Open iWEP Pro app
2. Click top-right corner "i" button
3. Click "Validate application"
4. Enter 3 or more letters or numbers in "PayPal Transaction ID"
5. Tap "Validate License" 
Activate Your Licence in 5 & 5.0.1
1. Open iWEP Pro app
2. Tap on "Settings" tab
3. Tap on "Register application"
4. Enter at least 3 letters/numbers into "PayPal Code" field
5. Tap on "Validate" button

Using the App
The MAC address is shown during the network scan, signal strength is shown and you can also connect and test the password through the app. Another good thing is that he offers a trial which is ad supported. Here is a list of supported networks. Do any of these look familiar?


Table 2: Supported Networks

WLAN_XX
WiFIXXXXXX
ThomsonXXXXXX
DmaxXXXXXX
WLAN_XXXX
WiFiXXXXXX
BTHomeHub-XXXX
Orange-XXXXX
JAZZTEL_XXXX
YACOMXXXXXX
INFINITUMXXXXXX
CytaXXXXXX
WLANXXXXXX
SpeedTouchXXXXXX
Bbox-XXXXXX
TN_private_XXXXXX
BigPondXXXXXX
Alice_XXXXXXX
O2wirelessXXXXXX
FastWeb-1-XXXXXXX
DlinkXXXXXX
BlinkXXXXXX
SKYXXXXX
EircomXXXX XXXX


iWep Pro Network Scan
Manual Lookup

2 WPA Tester
The only iTunes app that made the cut supports a similar large range of networks as iWep Pro but functionality is quite limited with manual input of network names (SSID). The app is a little misleading in the description as it states a whole host of networks that this app supports. But ISPs do not stick to one router model or vendor, they have a variety. So, as an example, if you have a Verizon router, chances are that it is not supported. Supported Networks:

Australia BigPond
U.S. Verizon
U.K. BTHomeHub, Sky
Italy Alice, Fastweb, InfostradaWiFi, TeleTù, Tele2
Spain Ono, JAZZTEL, YaCOM, WiFi, ADSL
Portugal Vodafone, Meo, Sapo, Zon
Ireland Eircom
France Bbox
Mexico INFINITUM
Greece OTEnet
Cyprus Cyta
Many Countries Huawei, Dlink, Tecom, Discus, WLAN, D-LINK, WIRELESS, O2Wireless, Thomson, SpeedTouch, privat, DMAX, Orange


This app is only good for Thomson based routers that usually have a combination ending of six capital letters and numbers XXXXXX. It supports offline mode, network scanning and you will have to download the rainbow tables in order to use it.

This is not an app but an actual online tool that can be accessed on any computer. It is worthy of bookmark status on your phone and your computer. Again, this is only good for Thomson / SpeedTouch based routers and it works just as good as iWep Pro for hacking SpeedTouch / Thomson routers. MD5This also has something very similar.

Web based Thomson SSID lookup found three keys

From the same developer as iWep Pro, this is only good for Thomson / SpeedTouch based routers and the fwssid app is also good for Fastweb routers. You will have to manually input the XXXXXX part of the SSID and a button will pop up, allowing you to copy the password to your device.

SpeedSSID found two keys

Table 3: Supported Networks

ThomsonXXXXXX
Orange-XXXXXX
INFINITUMXXXXXX
TN_private_XXXXXX
SpeedTouchXXXXXX
DMAXXXXXX
Bbox-XXXXXX
CYTAXXXXXX


This has the same GUI / function as the SpeedSSID app and it claims to be able to generate network keys from Dlink routers. I have not had any success with this app so I cannot comment on its effectiveness. Probably because Dlink put out so many different models out each year. However, it is from a reputable developer and I am hoping to find out from anyone who was able to get this app to work.

This app is good for Eircom routers with the distinctive XXXX XXXX after the name which are used extensively in Ireland. Same GUI as the above, however unlike the others, you are able to scan for networks and view a google map of every router that has been sniffed. 

Pinned locations of routers, many more now
8 Others Currently Under Development
iWep Pro 5 will likely be out soon, with a more refined UI (check out the screenshots) and hopefully better cracking features. They are certainly ones to watch. Another one to watch out for is ST Keys for iOS.

9 Other Tools
There is an interesting app available in Cydia called WiFi Pass (BigBoss repo). It logs any WiFi password you type into your phone and displays it in the app. There is also an iTunes app called Passmule that has the default administrator passwords of many vendors and models. I managed to get into this network by doing so.  


Passmule in action
Keep in mind that these passwords would only be of use accessing the router settings and not the actual WiFi network itself. 

10 Network Sniffers Free WiFi Locations

Stumblers such as WiFi Where, WiFiFoFum and WiFi Analyzer can be really helpful. You should have at least one in your toolkit. They show information such as MAC addresses, IP addresses, encryption, free WiFi hotspots, router vendors and help in determining which networks are within range.


My favourite is WiFi Where because it is great for wardriving, warcycling and warwalking. You can ignore certain networks, such as WPA, WPA2, open, adhoc and out of range networks from showing. The app also has the ability to filter network strength and location accuracy. 


WiFi Where Screenshots
Hotspot Details
Scan
Settings
More Settings
The best part of WiFi where is that you can export information via email into a spreadsheet file and create your own map showing networks around your neighbourhood because it logs latitude and longitude. I created the following map below in Google Fusion Tables. Check it out, zoom and click on the dots for cool information :)


11 Beware
iDevices have limited processing power and hardware to be able to brute-force attack WEP / WPA Wi-Fi networks. Any app that claims to do this (e.g. iWifihack, WEPGen, Ch0ry and Wi-Fi Joker), is lying and wasting your time (by making you do surveys) and possibly stealing your money. Aircrack-ng the popular Linux / Backtrack suite of penetration testing has been ported to the iPhone as a proof of concept. However, it is a hardware limitation where the iDevices WiFi card cannot inject or collect packets. Therefore it doesn't work!



If you tried all of the above apps and you were unsuccessful and if you have a computer and willing to spend some money. I suggest you check out my other videos to show you how it is done through essential hardware as well as through using powerful software such as BackTrack and Beini virtual machines (VM).  


Video of Some of these Tools in Action

12 Other Devices
There have been a number of apps developed for other operating systems and devices that work in a similar fashion. There are even operating systems based on Linux, including: Xiaopan OS (Free), WiFiway, Krackeraki (Free) and BackTrack (Free), Reaver Pro (Great for hacking WPA/WPA2 WPS Networks). These were packaged and developed specifically for hacking. 
Did you also know you can run virtually any operating system within another operating system? e.g. run Windows XP in Windows 7 or Beini in Mac). It is simply done through virtualisation software like Parallels, VMware or VirtualBox.