[Oxycodone]

New to wifi hacking and all that, but I noticed a lot of places who offer public wifi, or even stores use simple passwords so their employees can easily access it.
& I notice their router credentials are usually just the defaults. (admin/admin admin/password etc..)

What I've been doing is enabling remote management if the router offers it. I should be able to update the firmware from anywhere im at if I understand how linksys routers work.

So I know I can sniff traffic and all that, but I was wondering if people create firmware updates that are backdoored or something of the sort so even if they reset the router/change login credentials I'd be able to still gain access?

& I was also wondering how I would go about bricking the router aswell? (Purposely) So even resetting wont fix it. I see this as a huge risk to businesses relying on internet connections for sales. Would uploading any file work? Or downloading a firmware update and corrupting the file and upload it?

[pomwtin]

You can check out my router backdooring example thread (pictures do not show due to non https url, so copy-paste url to see them).
It is simplifyed using ddwrt, but same thing can be achieved with original firmware and some more skills.

[Anzee]

Of course, you could easily build your own firmware using DD-WRT that would still mimic the original AP's settings but allow you more control over the device. Since it's a Linux based firmware you could run services to proxy traffic potentially add JS scripts to every page they visit and steal credentials or cookies without them having a clue.

[pomwtin]

Mine example sends current password and username to specified email whenever pass is changed or router rebooted... it is quite simple

[Silkroad]

Mine example sends current password and username to specified email whenever pass is changed or router rebooted... it is quite simple

This is simple and effective.

DDWRT is the way to go for this purpose imo, otherwise a simple router reset and it's back to factory defaults.