Security
researchers have identified some wireless routers of having default
passwords derived from a routers MAC address (e.g D8:3A:32:28:21:72) or
SSID (network name). Read this to learn more. To determine what vendor the WiFi network is on, you can lookup the MAC address here or download the MAC address lookup app.
Now, If you are serious about security auditing and hacking WiFi, the iPhone is a poor choice of technology. Some of you might want to become advanced and improve your success rate with a good WiFi hacking long-range setup through your computer with Beini or BackTrack. However, it still is very possible with an iPhone and there are a number of freely available apps in Cydia (if you don't have your iDevice jailbroken, look in the right hand pane of this page and enter your iDevice information in the 'Jailbreak Wizard' to see how jailbreak) and iTunes that are able to recover these passwords. If you have Cydia, you should add BigBoss and xSellize repos and type in 'SSID' to get most of the apps listed below.
This will not work if the default password has been changed. My success rate of gaining entry into a compatible router is ~65%. The comparison table gives you an idea how the apps compare side-by-side:
Table 1: Best iDevice WiFi Hacking Apps
* Can be downloaded for free via appcake or apptrackr, still requires a jailbreak, afc2add and AppSync from Cydia.
** Can be downloaded for free via xSellize repo in Cydia.
There are a few more available in iTunes, but they have an ugly GUI or in a foreign language:
Universal WPA Finder $0.99
WiFi WPA $1.99
WPA Inspector $1.99
HAG WPA Finder $0.99
You can also search the app store for any WiFi related app (if it is not showing to your right, temporarily disable adblock). Suggested search terms: wifi, wep, wpa, ssid, network.
1 iWep Pro
The developer over at iWazDev has created the best, feature packed and most expensive (or free if you decide to download it from a repo that hosts cracked apps) WiFi auditing tool out there. It is also the most difficult to setup as you are required to download 12 iWep Pro dictionaries in Cydia (2004 to 2011) for offline use.
Installation Instructions
If you do not want to spend the hefty price tag, you can download the latest 5.0.1 or 4.1.3 HERE
1. Dictionary Downloads (Download them all)
New iWazowski Cydia Repo
There is a new temporary repo if the links above do not work: http://iwazowski.hostzi.com/repo/
Dictionaries are DEB files, and have to be installed just like all other DEBs (using iFile or via MobileTerminal / SSH) or downloading them from the iWazowski repo: http://iwazowski.com/repo/. They extract as speedSHA1dic files.
Check out the video below on how to install it or use the written instructions.
2. Upload the files to your device
First, you have to know where you want the .deb files (e.g /var/mobile/Media/Downloads) and upload the files on to your device. Best to use the easier method.
3. Install iWep Pro & Dictionaries
Easiest Method
1. Start Cydia, go to 'Search', type 'Mobile Terminal' and install it (if you haven't yet). Be aware that there are different versions for different iOSs.
2. Repeat step 1 for 'OpenSSH'
3. Start 'MobileTerminal'
4. Type the following:
• su root (press return)
• alpine (press return)
Install iWep Pro and the Dictionaries through Mobile Terminal e.g. type:
dpkg -i /var/mobile/Media/Downloads/iWep Pro 4.1.3.deb (Note you can rename the.deb files e.g 1.deb which will make it quicker to install) and do that with the rest of the files you downloaded.
4. Open the App
Activate Your Licence in 5 & 5.0.1
1. Open iWEP Pro app
2. Tap on "Settings" tab
3. Tap on "Register application"
4. Enter at least 3 letters/numbers into "PayPal Code" field
5. Tap on "Validate" button
Using the App
The MAC address is shown during the network scan, signal strength is shown and you can also connect and test the password through the app. Another good thing is that he offers a trial which is ad supported. Here is a list of supported networks. Do any of these look familiar?
Table 2: Supported Networks
2 WPA Tester
The only iTunes app that made the cut supports a similar large range of networks as iWep Pro but functionality is quite limited with manual input of network names (SSID). The app is a little misleading in the description as it states a whole host of networks that this app supports. But ISPs do not stick to one router model or vendor, they have a variety. So, as an example, if you have a Verizon router, chances are that it is not supported. Supported Networks:
Australia BigPond
U.S. Verizon
U.K. BTHomeHub, Sky
Italy Alice, Fastweb, InfostradaWiFi, TeleTù, Tele2
Spain Ono, JAZZTEL, YaCOM, WiFi, ADSL
Portugal Vodafone, Meo, Sapo, Zon
Ireland Eircom
France Bbox
Mexico INFINITUM
Greece OTEnet
Cyprus Cyta
Many Countries Huawei, Dlink, Tecom, Discus, WLAN, D-LINK, WIRELESS, O2Wireless, Thomson, SpeedTouch, privat, DMAX, Orange
9 Other Tools
There is an interesting app available in Cydia called WiFi Pass (BigBoss repo). It logs any WiFi password you type into your phone and displays it in the app. There is also an iTunes app called Passmule that has the default administrator passwords of many vendors and models. I managed to get into this network by doing so.
Keep in mind that these passwords would only be of use accessing the router settings and not the actual WiFi network itself.
10 Network Sniffers Free WiFi Locations
Stumblers such as WiFi Where, WiFiFoFum and WiFi Analyzer can be really helpful. You should have at least one in your toolkit. They show information such as MAC addresses, IP addresses, encryption, free WiFi hotspots, router vendors and help in determining which networks are within range.
My favourite is WiFi Where because it is great for wardriving, warcycling and warwalking. You can ignore certain networks, such as WPA, WPA2, open, adhoc and out of range networks from showing. The app also has the ability to filter network strength and location accuracy.
The best part of WiFi
where is that you can export information via email into a spreadsheet
file and create your own map showing networks around your neighbourhood
because it logs latitude and longitude. I created the following map
below in Google Fusion Tables. Check it out, zoom and click on the dots for cool information :)
11 Beware
iDevices have limited processing power and hardware to be able to brute-force attack WEP / WPA Wi-Fi networks. Any app that claims to do this (e.g. iWifihack, WEPGen, Ch0ry and Wi-Fi Joker), is lying and wasting your time (by making you do surveys) and possibly stealing your money. Aircrack-ng the popular Linux / Backtrack suite of penetration testing has been ported to the iPhone as a proof of concept. However, it is a hardware limitation where the iDevices WiFi card cannot inject or collect packets. Therefore it doesn't work!
If you tried all of the above apps and you were unsuccessful and if you have a computer and willing to spend some money. I suggest you check out my other videos to show you how it is done through essential hardware as well as through using powerful software such as BackTrack and Beini virtual machines (VM).
Now, If you are serious about security auditing and hacking WiFi, the iPhone is a poor choice of technology. Some of you might want to become advanced and improve your success rate with a good WiFi hacking long-range setup through your computer with Beini or BackTrack. However, it still is very possible with an iPhone and there are a number of freely available apps in Cydia (if you don't have your iDevice jailbroken, look in the right hand pane of this page and enter your iDevice information in the 'Jailbreak Wizard' to see how jailbreak) and iTunes that are able to recover these passwords. If you have Cydia, you should add BigBoss and xSellize repos and type in 'SSID' to get most of the apps listed below.
This will not work if the default password has been changed. My success rate of gaining entry into a compatible router is ~65%. The comparison table gives you an idea how the apps compare side-by-side:
Table 1: Best iDevice WiFi Hacking Apps
Name
|
Cost
|
Store
|
Offline
|
MAC Shown
|
Signal Strength
|
Network Scan
|
Connect in App
|
$8.19
|
Cydia
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
| |
$1.99
|
iTunes
|
No
|
No
|
No
|
No
|
No
| |
Free
|
Cydia
|
Yes
|
Yes
|
Yes
|
Yes
|
No
| |
Free
|
Internet
|
No
|
No
|
No
|
No
|
No
| |
$3.99
|
Cydia
|
No
|
No
|
No
|
No
|
No
| |
dessid**
|
$2.25
|
Cydia
|
No
|
No
|
No
|
No
|
No
|
fwssid**
|
$3.99
|
Cydia
|
No
|
No
|
No
|
No
|
No
|
* Can be downloaded for free via appcake or apptrackr, still requires a jailbreak, afc2add and AppSync from Cydia.
** Can be downloaded for free via xSellize repo in Cydia.
There are a few more available in iTunes, but they have an ugly GUI or in a foreign language:
Universal WPA Finder $0.99
WiFi WPA $1.99
WPA Inspector $1.99
HAG WPA Finder $0.99
You can also search the app store for any WiFi related app (if it is not showing to your right, temporarily disable adblock). Suggested search terms: wifi, wep, wpa, ssid, network.
1 iWep Pro
The developer over at iWazDev has created the best, feature packed and most expensive (or free if you decide to download it from a repo that hosts cracked apps) WiFi auditing tool out there. It is also the most difficult to setup as you are required to download 12 iWep Pro dictionaries in Cydia (2004 to 2011) for offline use.
Installation Instructions
If you do not want to spend the hefty price tag, you can download the latest 5.0.1 or 4.1.3 HERE
1. Dictionary Downloads (Download them all)
iWep PRO Dictionary for BTHomeHub Routers:
iWep PRO Dictionary for Thomson Based Routers:
Password to download the files is: dishingtech
New iWazowski Cydia Repo
There is a new temporary repo if the links above do not work: http://iwazowski.hostzi.com/repo/
Dictionaries are DEB files, and have to be installed just like all other DEBs (using iFile or via MobileTerminal / SSH) or downloading them from the iWazowski repo: http://iwazowski.com/repo/. They extract as speedSHA1dic files.
Check out the video below on how to install it or use the written instructions.
2. Upload the files to your device
First, you have to know where you want the .deb files (e.g /var/mobile/Media/Downloads) and upload the files on to your device. Best to use the easier method.
3. Install iWep Pro & Dictionaries
Easiest Method
- Install iFile from Cydia
- Download iFunbox, Cyberduck or iExplorer (or install afc2add and openSSH in Cydia)
- Download desired (.debs) files (if you haven't yet) to your desktop
- Run one of the apps and connect your iPhone, iPod or iPad usb cable
- The program will show your device contents, Now navigate to any folder for example: var/mobile/Documents (if you can't access the root directory, download afc2add in Cydia)
- Move (.deb) files from your desktop to var/mobile/Documents
- Run iFile from your iOS, and navigate to the same folder i.e. var/mobile/Documents
- Click on (.deb) file and select install one by one until you install all the required dictionaries
1. Start Cydia, go to 'Search', type 'Mobile Terminal' and install it (if you haven't yet). Be aware that there are different versions for different iOSs.
2. Repeat step 1 for 'OpenSSH'
3. Start 'MobileTerminal'
4. Type the following:
• su root (press return)
• alpine (press return)
Install iWep Pro and the Dictionaries through Mobile Terminal e.g. type:
dpkg -i /var/mobile/Media/Downloads/iWep Pro 4.1.3.deb (Note you can rename the.deb files e.g 1.deb which will make it quicker to install) and do that with the rest of the files you downloaded.
When you install the files and you Finish with Result Code 256 error message?
It
means you made a mess of installations. You have previously tried to
install the app. Basically it already exists and there’s a conflict, and
hence dpkg throws you an error because it cannot rewrite it.
How to fix?
The
best way to fix this problem is to completely uninstall and remove all
previous instances of the app. That means uninstalling via Cydia and
also going in and manually removing the app files if necessary from the
iWep Pro folder. You could also try the following commands: dpkg --force-depends -i thenameofthefile.deb to install and dpkg --force-depends -r nameofpackage to remove.
If you finish with with Result Code 512 error message?
It means that the file/s are in use. Probably Cydia is running, try closing Cydia in the background and try installing again.
Try again and success means you end up with result code 0.
Note: You must be connected to WiFi, 3G or EDGE to activate your licence. iPad and iTouch users will need WiFi or 3G.
Activating Your Licence in 4.1.3
1. Open iWEP Pro app
2. Click top-right corner "i" button
3. Click "Validate application"
4. Enter 3 or more letters or numbers in "PayPal Transaction ID"
5. Tap "Validate License"
1. Open iWEP Pro app
2. Tap on "Settings" tab
3. Tap on "Register application"
4. Enter at least 3 letters/numbers into "PayPal Code" field
5. Tap on "Validate" button
Using the App
The MAC address is shown during the network scan, signal strength is shown and you can also connect and test the password through the app. Another good thing is that he offers a trial which is ad supported. Here is a list of supported networks. Do any of these look familiar?
Table 2: Supported Networks
WLAN_XX
|
WiFIXXXXXX
|
ThomsonXXXXXX
|
DmaxXXXXXX
|
WLAN_XXXX
|
WiFiXXXXXX
|
BTHomeHub-XXXX
|
Orange-XXXXX
|
JAZZTEL_XXXX
|
YACOMXXXXXX
|
INFINITUMXXXXXX
|
CytaXXXXXX
|
WLANXXXXXX
|
SpeedTouchXXXXXX
|
Bbox-XXXXXX
|
TN_private_XXXXXX
|
BigPondXXXXXX
|
Alice_XXXXXXX
|
O2wirelessXXXXXX
|
FastWeb-1-XXXXXXX
|
DlinkXXXXXX
|
BlinkXXXXXX
|
SKYXXXXX
|
EircomXXXX XXXX
|
 |
| iWep Pro Network Scan |
 |
| Manual Lookup |
2 WPA Tester
The only iTunes app that made the cut supports a similar large range of networks as iWep Pro but functionality is quite limited with manual input of network names (SSID). The app is a little misleading in the description as it states a whole host of networks that this app supports. But ISPs do not stick to one router model or vendor, they have a variety. So, as an example, if you have a Verizon router, chances are that it is not supported. Supported Networks:
Australia BigPond
U.S. Verizon
U.K. BTHomeHub, Sky
Italy Alice, Fastweb, InfostradaWiFi, TeleTù, Tele2
Spain Ono, JAZZTEL, YaCOM, WiFi, ADSL
Portugal Vodafone, Meo, Sapo, Zon
Ireland Eircom
France Bbox
Mexico INFINITUM
Greece OTEnet
Cyprus Cyta
Many Countries Huawei, Dlink, Tecom, Discus, WLAN, D-LINK, WIRELESS, O2Wireless, Thomson, SpeedTouch, privat, DMAX, Orange
This
app is only good for Thomson based routers that usually have a
combination ending of six capital letters and numbers XXXXXX. It
supports offline mode, network scanning and you will have to download
the rainbow tables in order to use it.
This
is not an app but an actual online tool that can be accessed on any
computer. It is worthy of bookmark status on your phone and your
computer. Again, this is only good for Thomson / SpeedTouch based
routers and it works just as good as iWep Pro for hacking SpeedTouch /
Thomson routers. MD5This also has something very similar.
 |
| Web based Thomson SSID lookup found three keys |
From
the same developer as iWep Pro, this is only good for Thomson /
SpeedTouch based routers and the fwssid app is also good for Fastweb
routers. You will have to manually input the XXXXXX part of the SSID and
a button will pop up, allowing you to copy the password to your device.
 |
| SpeedSSID found two keys |
Table 3: Supported Networks
ThomsonXXXXXX
|
Orange-XXXXXX
|
INFINITUMXXXXXX
|
TN_private_XXXXXX
|
SpeedTouchXXXXXX
|
DMAXXXXXX
|
Bbox-XXXXXX
|
CYTAXXXXXX
|
6 dlssid
This
has the same GUI / function as the SpeedSSID app and it claims to be
able to generate network keys from Dlink routers. I have not had
any success with this app so I cannot comment on its effectiveness.
Probably because Dlink put out so many different models out each year.
However, it is from a reputable developer and I am hoping to find out
from anyone who was able to get this app to work.
7 Dessid
This app is good for Eircom routers with the distinctive XXXX XXXX after the name which are used extensively in Ireland. Same
GUI as the above, however unlike the others, you are able to scan for
networks and view a google map of every router that has been sniffed.
 |
| Pinned locations of routers, many more now |
8 Others Currently Under Development
iWep Pro 5 will
likely be out soon, with a more refined UI (check out the screenshots)
and hopefully better cracking features. They are certainly ones to
watch. Another one to watch out for is ST Keys for iOS.
9 Other Tools
There is an interesting app available in Cydia called WiFi Pass (BigBoss repo). It logs any WiFi password you type into your phone and displays it in the app. There is also an iTunes app called Passmule that has the default administrator passwords of many vendors and models. I managed to get into this network by doing so.
 |
| Passmule in action |
10 Network Sniffers Free WiFi Locations
Stumblers such as WiFi Where, WiFiFoFum and WiFi Analyzer can be really helpful. You should have at least one in your toolkit. They show information such as MAC addresses, IP addresses, encryption, free WiFi hotspots, router vendors and help in determining which networks are within range.
My favourite is WiFi Where because it is great for wardriving, warcycling and warwalking. You can ignore certain networks, such as WPA, WPA2, open, adhoc and out of range networks from showing. The app also has the ability to filter network strength and location accuracy.
WiFi Where Screenshots
 |
| Hotspot Details |
 |
| Scan |
 |
| Settings |
 |
| More Settings |
11 Beware
iDevices have limited processing power and hardware to be able to brute-force attack WEP / WPA Wi-Fi networks. Any app that claims to do this (e.g. iWifihack, WEPGen, Ch0ry and Wi-Fi Joker), is lying and wasting your time (by making you do surveys) and possibly stealing your money. Aircrack-ng the popular Linux / Backtrack suite of penetration testing has been ported to the iPhone as a proof of concept. However, it is a hardware limitation where the iDevices WiFi card cannot inject or collect packets. Therefore it doesn't work!
If you tried all of the above apps and you were unsuccessful and if you have a computer and willing to spend some money. I suggest you check out my other videos to show you how it is done through essential hardware as well as through using powerful software such as BackTrack and Beini virtual machines (VM).
Video of Some of these Tools in Action
12 Other Devices
There have been a number
of apps developed for other operating systems and devices that work in a
similar fashion. There are even operating systems based on Linux,
including: Xiaopan OS (Free), WiFiway, Krackeraki (Free) and BackTrack (Free), Reaver Pro (Great for hacking WPA/WPA2 WPS Networks). These were packaged and developed specifically for hacking.
Did you also know you can run virtually any operating system within another operating system? e.g. run Windows XP in Windows 7 or Beini in Mac). It is simply done through virtualisation software like Parallels, VMware or VirtualBox.
