How do I semi-automatically guess Wifi passwords?
EDIT:

There's now a project that got monitor mode working on the Galaxy S2 and the Google Nexus One.
See http://bcmon.blogspot.de/

As far as I know there's currently no WEP/WPA cracking app. The fact Android is open and Linux based would allow this basically, however most (all?) wifi chipset drivers don't allow the necessary monitor mode and solutions would be tied to single makes/models with supported chipsets. Using known working USB wifi adapters with OTG ready devices would allow to circumvent this restriction but there has not been a project to do so yet. Update: There's  some effort by the author of Kismet.

This is not covering your question but is somewhat related:
You might however have luck using these 2 tools (root required):
Element53 and ProxyDroid

Background:
Many paid access points allow DNS resolution. Element53 is a TCP-over-DNS tunnel app (DNS has port 53, hence the name) to exploit this. The free version has 10MB traffic limit, here's the explanation from the Google Play:


  Element53, the DNS tunnel for Android.  
  
  Element53 is a ready-to-use DNS-tunnel for Android. It can be used for
  penetration testing (other uses are not supported).