First of all, I am not responsible for any bad things that you will do with this trick. Remember that this trick is an illegal work.Use this trick just for experiment I want to tell you about a bug in some WiFi modems with open WPS.

For this trick you need to do:

1. you need a rooted android phone.

2. Then install Busy Box on your rooted android phone.

3. Install "WPS Wpa tester premium" on your phone.

4. Enter "WPS Wpa tester premium" and grant root access.

5. Tap the "Refresh" Icon as you see in following screen shot (the icon in a red circle):

6. You see the networks around you with a green or red lock icon.A green lock means that this network has open wps and you can hack it. A red lock means that it is a network with closed wps and you can not hack it.

7. Tap on one of network with green lock and then tap on "Connect(Root)" . Then choose one of pin and tap on "Connect(root)" .

8. If you failed, try another pin.

9. In this trick finding the WiFi password depends on : distance between you and the modem , supporting this program's driver by your phone's chipset and the mac filter in the modem. So for a better chance, reduce your distance form modem and select a modem that dose not have mac filter. The program's driver is supported by almost all of Sony and Samsung model and some of Huawei model.

10. There is an another Program that is very similar to Wps Wpa tester premium : "WPS Connect". also try it.

11. Use this trick just for experiment and to find a way to close WPS and this bug.
Good luck