Find router IP

S

Stoly

Supreme [H]ardness
Joined
Jul 26, 2005
Messages
6,713
Apparently someone hacked a router of one of my clients.

It seems DHCP has been disabled and ip has changed.

I have no physical access to the router as its locked on a cabinet. So no reset button at least until next monday.

I need to retrieve the IP address so I can reset it and re-enable DHCP.

It seems to work since wifi is enabled and I can connect to it as the WPA key (edit not wep key) was not changed.

any ideas?
 
Last edited:
Are there any managed switches on the network you could log into and check ARP table?

Has the subnet changed also?

How do you know it was hacked? maybe it went to default settings and is using a new default IP?
 
Need more info ... what kind of router etc lol

Orrr someone hit the reset button and didn't want to get yelled at said we got hacked lol
 
Find the model of your router and check the setup guide/manual for the defaqult IP then change your IP to static on that same subnet and see if you can connect.
 
If the router is the default gateway, connect via wifi and note your adapter's default gateway IP.
 
Connect to router -> Command prompt --> ipconfig -> Note gateway -> Enter into browser
 
AMD_Gamer said:
Are there any managed switches on the network you could log into and check ARP table?

Has the subnet changed also?

How do you know it was hacked? maybe it went to default settings and is using a new default IP?
Click to expand...

No managed switches.

I've been told the router has been messed around before, changing the firewall settings to unlock some sites. Hence the possibility of a hack
Default ip doesn't work.
 
Stoly said:
I've been told the router has been messed around before, changing the firewall settings to unlock some sites. Hence the possibility of a hack
Default ip doesn't work.
Click to expand...

Plus the fact it's using WEP, which is hackable in minutes.:rolleyes:
 
Sorry, but all the suggestions are based on that I have an ip address assigned by dhcp.

Since DHCP is disabled, ipconfig does nothing, and I don't have a gateway.
 
Stoly said:
Sorry, but all the suggestions are based on that I have an ip address assigned by dhcp.

Since DHCP is disabled, ipconfig does nothing, and I don't have a gateway.
Click to expand...

Ok what model is the router in question?
 
Some of those home style routers can be accessed by entering a url in your browser and not using an ip address. Probably won't work though until the pc has an IP on the same subnet.
 
So you have access to the location, just not access to the cabinet that the AP is in, right? Is there any possibility of getting wireshark running on a laptop?

If so, join the wireless network, assign a fake IP and turn on wireshark. Watch the arp traffic, look for the network range as well as a possible router IP. If you fail to find the router IP address with that, reassign your network care in the range you observed, then run nmap to find all IPs on the network. Then just poke away until you find the router.
 
XOR != OR said:
So you have access to the location, just not access to the cabinet that the AP is in, right? Is there any possibility of getting wireshark running on a laptop?

If so, join the wireless network, assign a fake IP and turn on wireshark. Watch the arp traffic, look for the network range as well as a possible router IP. If you fail to find the router IP address with that, reassign your network care in the range you observed, then run nmap to find all IPs on the network. Then just poke away until you find the router.
Click to expand...

I'm gonna try that. I thought it was linux only. But I see there's a windows version.
 
XOR != OR said:
So you have access to the location, just not access to the cabinet that the AP is in, right? Is there any possibility of getting wireshark running on a laptop?

If so, join the wireless network, assign a fake IP and turn on wireshark. Watch the arp traffic, look for the network range as well as a possible router IP. If you fail to find the router IP address with that, reassign your network care in the range you observed, then run nmap to find all IPs on the network. Then just poke away until you find the router.
Click to expand...

Can you run wireshark in listen mode without an IP assigned to an interface?
 
You must log in or register to reply here.
Back
Top