However if you gain wireless access to the device (which isn’t difficult if it’s on WEP) you will find the default password has been changed to the serial number of the device (unless the owner changed it since).

Now you might think getting the serial number would be impossible without physical access, but using the firmware recovery tool provided by BT it will tell you the serial number on finding it. Then all you do is add the two characters ‘CP’ infront of it to make it valid e.g. CP01234ABCD.

From there I guess the possibility lies with downgrading the firmware to a more vulnerable version.

You’re right though, if you want to be perfectionist, the definitions on ’steal.php’ should be under the IF statement.

@G-Brain - ’steal.php’ is derived from a generic data theft script I wrote long time ago. The idea of the original script is that it works for both, GET and POST, hence the use of $_REQUEST .

btw guys, there is video we’re posting soon on this very same page showing a DoS on the BT Home Hub. The exploit takes advantage of the double slash auth bypass + CSRF to disable the wireless connection.

Although I usually don’t like DoS attacks, I must say that this one is kind of a killer. Just visit site, and boom, the Home Hub’s wireless interface is disabled permanently!

I’d use $_POST['data'] instead of $_REQUEST['data'] in steal.php though. $_REQUEST contains $_GET, $_POST, and $_COOKIE, and all you need here is $_POST. Furthermore, good job! Nice article.