Leaderboard


Popular Content

Showing content with the highest reputation since 05/19/2018 in all areas

  1. 3 points
    I've worked on this project for quite a while, and have discussed it on the conference, but have never officially posted recordings on here. There is a large presence of analog and electromechanical switches still in service in the former Soviet countries. The following are 3 recordings of me successfully boxing some of these switches: East Ukraine, ATSK Crossbar Using SF (in-band 2600 dial pulse) Signaling -- seizing and SFing another number: http://technotite.com/SF-exampUKR1.wav West Russia, Crossbar Using SF (in-band 2600 dial pulse) Signaling -- seizing and SFing another number: http://technotite.com/SF-exampRUS1.wav East Ukraine, Crossbar Using R1.5 (weird bi-directional MF protocol using R1 tones, used in CIS countries) - seizing and MFing another number: http://technotite.com/R1.5-examp1.wav
  2. 3 points
    Just found this photo and article, figured I'd leave it here. https://www.rcrwireless.com/20171109/network-infrastructure/switching-it-up-bidding-farewell-to-the-1aess-switch-tag6
  3. 2 points
    at various points in my life i've written little handscanner assistant utilities.. yes, i know there are some already out there - whatever.. i like to code. i've been working on a new project called cons0le (and cons0le-web). i restarted this project because i recently obtained a dialogic diva card and wanted to play with some of the features of the card. at this point i am reaching out to see what realistic features any of you might want to see added to such an app... It is a windows based app written in vb.net and also a javascript counterpart web based app. current working or to be worked on items are: - random/sequential dialing of multiple npa/pre/suff - extreme scheduling/timing of scan jobs - dtmf detection - dtmf send either via dial string or live during call via mouse clicks - outgoing .wav either on outgoing calls or incoming calls - tone detection in general - definable call documentation as well as presets (vmb, ringout, etc..) - sync with a master web app which will provide a "phone book" type interface - master web app will also be able to generate npa/pre/suff and log calls via presets/user definable buttons - f2f syncing of results files. (encryption type is still up in the air on this..) All of the above is already set in stone.. I would love to hear any suggestions for other features though.. doc
  4. 2 points
    There's few things in this world that remain shrouded in secrecy for twenty years, but 711 numbers and their foundation have done an excellent job of exactly that. That all changed though, with a post in the some numbers thread. More specifically, with two numbers: (800) 860 0169 and (800) 860 0867. Don't bother checking, they're both the same. When you call either, crunchy, 20 year old ADPCM crackles to life with "This is the West Interactive audio system. Enter your access code now." The access codes as it turns out, are pretty easy to guess. The passwords, equally so. I'll share a list at the end of this. But assuming you're not lazy or intimidated by phones and actually called, give it 7278 and password 7278. Then, push 3 to test the program. Sound familiar? So what, you may ask, is this thing exactly? The program itself is just a placeholder for unassigned numbers. Nothing special. The rest of the system is something else, though. Explore what I've found, and help continue the hunt if you like it. 0 - Reads back 811-000-0000 + invalid entry recording 1 - Doesn't allow call counter, allows blocked caller list, invalid, but works with password 0, 2 (plays announcement asking you to call 800-366-5588 with password 0) 2 - Invalid 3 - Invalid 4 - Doesn't allow call counter, invalid 5 - Reads back unit ID, line number, ACD test application 6 - Doesn't allow call counter, invalid 7 - Invalid 8 - Invalid? 9 - Reads back unit ID, line number, call time (local), plays fake busy signal 10 - <unassigned or new passcode> 11 - Invalid 12 - Doesn't allow call counter, invalid 13 - Hangs up 14 - Invalid 15 - <unassigned or new passcode> 16 - <unassigned or new passcode> 17 - Invalid 18 - <unassigned or new passcode> 19 - Doesn't allow prompt recording, ShopNBC IVR 20 - Invalid 21 - Invalid 22 - <unassigned or new passcode> 23 - <unassigned or new passcode> 24 - <unassigned or new passcode> 25 - <unassigned or new passcode> 26 - <unassigned or new passcode> 30 - Invalid (old psychic line) 96 - <unassigned or new passcode> 97 - <unassigned or new passcode> 98 - <unassigned or new passcode> 99 - Recorded beeps (x3) 00 - Reads back ? 01 - <unassigned or new passcode> 02 - <unassigned or new passcode> 000 - <unassigned or new passcode> 099 - <unassigned or new passcode> 100 - Doesn't allow prompt recording, invalid 101 - ShopNBC IVR 102 - Invalid 103 - <unassigned or new passcode> 104 - Prompts for APN number 105 - <unassigned or new passcode> 106 - <unassigned or new passcode> 107 - <unassigned or new passcode> 108 - <unassigned or new passcode> 109 - <unassigned or new passcode> 110 - <unassigned or new passcode> 111 - Doesn't allow call counter, invalid 112 - <unassigned or new passcode> 113 - <unassigned or new passcode> 114 - Allows blocked caller updating, Invalid 115 - <unassigned or new passcode> 116 - <unassigned or new passcode> 117 - <unassigned or new passcode> 122 - <unassigned or new passcode> 123 - Invalid 124 - No menu, hangs up promptly 125 - <unassigned or new passcode> 150 - <unassigned or new passcode> 166 - <unassigned or new passcode> 170 - <unassigned or new passcode> 180 - <unassigned or new passcode> 190 - <unassigned or new passcode> 200 - <unassigned or new passcode> 202 - <unassigned or new passcode> 211 - <unassigned or new passcode> 222 - Invalid 300 - <unassigned or new passcode> 303 - <unassigned or new passcode> 311 - <unassigned or new passcode> 322 - <unassigned or new passcode> 333 - No menu, Call accounts facility temporarily unavailable recording 400 - <unassigned or new passcode> 444 - Invalid 499 - <unassigned or new passcode> 500 - No options, immediately reads back 800-404-4890 and transfers 501 - <unassigned or new passcode> 502 - <unassigned or new passcode> 555 - Allows blocked caller update, invalid 599 - <unassigned or new passcode> 600 - <unassigned or new passcode> 611 - <unassigned or new passcode> 666 - Invalid 699 - <unassigned or new passcode> 700 - <unassigned or new passcode> 711 - <unassigned or new passcode> 777 - <unassigned or new passcode> 799 - <unassigned or new passcode> 800 - <unassigned or new passcode> 809 - <unassigned or new passcode> 810 - <unassigned or new passcode> 811 - Allows blocked caller update, <recorded beep tone> 812 - <unassigned or new passcode> 813 - <unassigned or new passcode> 888 - Allows blocked caller update, invalid 899 - <unassigned or new passcode> 900 - Invalid 901 - <unassigned or new passcode> 902 - <unassigned or new passcode> 958 - <unassigned or new passcode> 998 - <unassigned or new passcode> 999 - Same as main IVR on toll-free 000 - <unassigned or new passcode> 080 - <unassigned or new passcode> 0000 - Doesn't allow prompt recording, invalid 0001 - Invalid 0002 - Invalid 0003 - Reads back unit/line #, invalid call time + hangup 0005 - Invalid 0006 - Reads back 3547-179, phone number, caller #, "sorry, you did not ring" 0007 - Gives unit ID, line number, call time, xfers to operator 0008 - <invalid application> 0009 - Taco poll 0010 - <unassigned or new passcode> 0011 - Gives unit ID, line number, call time (local + epoch?), hangs up 0012 - Invalid 0013 - Voice capture thingie 0014 - <unassigned or new passcode> 0015 - <unassigned or new passcode> 0016 - <unassigned or new passcode> 0017 - <unassigned or new passcode> 0018 - <unassigned or new passcode> 0019 - <unassigned or new passcode> 0020 - <unassigned or new passcode> 0022 - <unassigned or new passcode> 0030 - <unassigned or new passcode> 0033 - <unassigned or new passcode> 0044 - <unassigned or new passcode> 0053 - <unassigned or new passcode> 0054 - <unassigned or new passcode> 0055 - Gives unit ID, line number, call time (local), billing test? Astro line, talks about charging $3.99/min 0056 - Invalid 0057 - <unassigned or new passcode> 0065 - <unassigned or new passcode> 0066 - Invalid 0067 - <unassigned or new passcode> 0077 - <unassigned or new passcode> 0087 - <unassigned or new passcode> 0088 - Invalid 0089 - <unassigned or new passcode> 0097 - <unassigned or new passcode> 0098 - <unassigned or new passcode> 0099 - Invalid 0100 - <unassigned or new passcode> 0101 - Invalid 0102 - <unassigned or new passcode> 0103 - <unassigned or new passcode> 0123 - <unassigned or new passcode> 0111 - <unassigned or new passcode> 0200 - <unassigned or new passcode> 0211 - <unassigned or new passcode> 0222 - Reads back unit ID, line number, 12345, hangs up 0298 - <unassigned or new passcode> 0299 - <unassigned or new passcode> 0300 - Invalid 0301 - Runs program w/o options, reads unit/line # and disconnects 0302 - Runs program w/o options, invalid, loops 0303 - No menu, cardholder services survey line, does voice capture for some reason near end of call 0304 - No menu, reads back unit ID, line number, "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the CSG box, press five. To change the ICOMS box, press six. To change the informix box, press seven. To change the CLASS database, press eight." 0305 - Doesn't allow call counts option, hangs up quickly 0306 - Hangs up quickly 0307 - <unassigned or new passcode> 0308 - <unassigned or new passcode> 0309 - Doesn't allow prompt recording, hangs up quickly 0310 - "Welcome to the <something> line", hangs up 0311 - "Hello world", hangs up 0312 - Invalid 0313 - Invalid 0314 - Invalid 0315 - Invalid 0316 - Invalid 0317 - <unassigned or new passcode> 0318 - <unassigned or new passcode> 0319 - <unassigned or new passcode> 0320 - <unassigned or new passcode> 0321 - <unassigned or new passcode> 0325 - <unassigned or new passcode> 0326 - <unassigned or new passcode> 0327 - Invalid 0328 - Invalid 0329 - Invalid 0330 - Invalid 0331 - <unassigned or new passcode> 0332 - <unassigned or new passcode> 0333 - Reads ten zeroes and disconnects 0334 - <unassigned or new passcode> 0340 - <unassigned or new passcode> 0400 - <unassigned or new passcode> 0403 - <unassigned or new passcode> 0404 - Call counts menu not available, invalid 0405 - Doesn't allow prompt recording, invalid 0406 - <unassigned or new passcode> 0407 - <unassigned or new passcode> 0408 - <unassigned or new passcode> 0409 - Invalid 0410 - Invalid 0411 - Invalid 0412 - Reads back unit number, line number, prompts for test DNIS, credit card number (client is Commdata) 0413 - Invalid 0414 - <unassigned or new passcode> 0415 - <unassigned or new passcode> 0444 - <unassigned or new passcode> 0500 - <unassigned or new passcode> 0501 - <unassigned or new passcode> 0502 - <unassigned or new passcode> 0503 - No call counts menu, invalid 0504 - No menu, hangs? 0505 - Hangs? 0506 - No menu, invalid, loops 0507 - <unassigned or new passcode> 0508 - <unassigned or new passcode> 0509 - <unassigned or new passcode> 0510 - Invalid 0511 - <unassigned or new passcode> 0512 - Doesn't allow prompt recording, invalid 0513 - No call counts menu, hangs? 0514 - No recording menu, hangs? 0515 - <unassigned or new passcode> 0516 - <unassigned or new passcode> 0517 - <unassigned or new passcode> 0519 - <unassigned or new passcode> 0520 - Invalid 0521 - Hangs? 0522 - <unassigned or new passcode> 0523 - <unassigned or new passcode> 0528 - <unassigned or new passcode> 0529 - <unassigned or new passcode> 0530 - Call counts option not available, does silent voice capture, plays back 0531 - <unassigned or new passcode> 0532 - <unassigned or new passcode> 0540 - <unassigned or new passcode> 0550 - <unassigned or new passcode> 0555 - <unassigned or new passcode> 0603 - <unassigned or new passcode> 0604 - <unassigned or new passcode> 0605 - <unassigned or new passcode> 0606 - Invalid 0607 - Reads back unit ID, line number, call time (020855), disconnects 0608 - Reads back unit ID, line number, call time (1529128930), Spanish order line, 4919 0609 - Invalid 0610 - <unassigned or new passcode> 0611 - Test recording of mic scuffling? Or invalid. 0612 - Invalid 0613 - <unassigned or new passcode> 0614 - Invalid 0615 - Invalid 0616 - <unassigned or new passcode> 0617 - <unassigned or new passcode> 0618 - Doesn't allow prompt recording, invalid 0619 - Invalid 0620 - <unassigned or new passcode> 0621 - Doesn't allow prompt recording, TTS voice, "Sorry, all of our agents are currently busy. Please try again later." 0622 - Invalid 0623 - <unassigned or new passcode> 0624 - Invalid 0625 - <unassigned or new passcode> 0626 - <unassigned or new passcode> 0627 - Recorded beeps x2, hangs? 0628 - Comcast Digital Phone IVR 0629 - <unassigned or new passcode> 0630 - Invalid 0631 - <unassigned or new passcode> 0632 - <unassigned or new passcode> 0633 - <unassigned or new passcode> 0634 - <unassigned or new passcode> 0635 - <unassigned or new passcode> 0636 - <unassigned or new passcode> 0637 - <unassigned or new passcode> 0638 - <unassigned or new passcode> 0700 - <unassigned or new passcode> 0705 - <unassigned or new passcode> 0706 - <unassigned or new passcode> 0707 - Invalid 0708 - Doesn't allow prompt recording, invalid 0709 - Invalid 0710 - <unassigned or new passcode> 0711 - Reads back unit ID, line number 0712 - Doesn't allow call counter, invalid 0713 - <unassigned or new passcode> 0714 - Invalid 0715 - <unassigned or new passcode> 0716 - <unassigned or new passcode> 0717 - Invalid 0718 - Doesn't allow running program 0719 - Doesn't allow prompt recording, Invalid 0720 - Invalid 0721 - <unassigned or new passcode> 0722 - Doesn't allow prompt recording, invalid 0723 - Invalid 0724 - Invalid 0725 - Invalid 0726 - Reads back unit ID, line number, call time, other time?, hangs up 0727 - Long silence, transfers to after hours rec 0728 - <unassigned or new passcode> 0729 - No menu, West hotline 0730 - <unassigned or new passcode> 0731 - <unassigned or new passcode> 0800 - <unassigned or new passcode> 0805 - <unassigned or new passcode> 0806 - <unassigned or new passcode> 0807 - <unassigned or new passcode> 0808 - Doesn't allow prompt recording, hangs up 0809 - <invalid application> 0810 - Reads back 358-596, 0811 - Reads back 3547-181 (unit ID, line number), starts recording audio samples 0812 - <unassigned or new passcode> 0813 - <unassigned or new passcode> 0900 - <unassigned or new passcode> 0907 - <unassigned or new passcode> 0908 - <unassigned or new passcode> 0909 - No menu, invalid, loops 0910 - <unassigned or new passcode> 0999 - <unassigned or new passcode> 1000 - Doesn't allow call counter, reads back strange numbers (398-399-99-11,111 222-2:52 AM) 1001 - Invalid 1002 - Invalid 1003 - <unassigned or new passcode> 1004 - Reads back unit ID, line number, prompts for date, hour, APN, ten digit MDN (Cricket phone number) 1005 - Allows blacklist updating, invalid 1006 - <unassigned or new passcode> 1007 - Doesn't allow prompt updating, invalid 1008 - Invalid 1009 - Invalid 1010 - <unassigned or new passcode> 1011 - <unassigned or new passcode> 1012 - <unassigned or new passcode> 1013 - Invalid 1014 - <unassigned or new passcode> 1015 - Invalid 1016 - Invalid 1017 - Record beep x2 1018 - Reads back unit number, line number, prompts for default/different scenario, test ANI. Scenarios read back four digit + two digit number, hang up 1019 - Same as 1018? 1020 - Doesn't allow prompt updating, gives 711 number-esque response (minus DTMF) 1021 - Only allows program testing/blacklist updating, reads off numbers and hangs up 1022 - <unassigned or new passcode> 1023 - Invalid 1024 - No menu, reads back unit ID, line number, routes to old Comcast IVR 1025 - <unassigned or new passcode> 1026 - <unassigned or new passcode> 1027 - "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the data rate, press five. To choose the program, press six, to change the host library, press seven." <default program number is eSecuritel customer service IVR> 1028 - Same as 1027? 1029 - Credit report ordering IVR, pulls docs from phone numbers, but may want street number/apartment/ZIP verification to read last name 1030 - Same as 1029? 1031 - "I'm sorry, due to heavy call volume, all our representatives are currently busy. Please try your call again later." 1032 - <unassigned or new passcode> 1033 - <unassigned or new passcode> 1034 - <unassigned or new passcode> 1035 - <unassigned or new passcode> 1036 - <unassigned or new passcode> 1037 - <unassigned or new passcode> 1038 - <unassigned or new passcode> 1039 - <unassigned or new passcode> 1040 - Allows voice prompt updating, reads back unit/line number, call time, drug info line IVR. Lots of voice prompts. 1041 - <unassigned or new passcode> 1042 - <unassigned or new passcode> 1043 - <unassigned or new passcode> 1044 - <unassigned or new passcode> 1045 - <unassigned or new passcode> 1046 - <unassigned or new passcode> 1047 - <unassigned or new passcode> 1050 - <unassigned or new passcode> 1060 - <unassigned or new passcode> 1068 - <unassigned or new passcode> 1069 - <unassigned or new passcode> 1070 - Invalid 1071 - Doesn't allow prompt recording, invalid 1072 - Doesn't allow prompt recording, invalid 1073 - <unassigned or new passcode> 1074 - <unassigned or new passcode> 1079 - <unassigned or new passcode> 1080 - <unassigned or new passcode> 1084 - <unassigned or new passcode> 1085 - <unassigned or new passcode> 1086 - <unassigned or new passcode> 1087 - Doesn't allow call recording, invalid 1088 - "I'm sorry, but that is an invalid entry. Please try again." 1089 - <unassigned or new passcode> 1090 - Doesn't allow prompt recording, DHL Express technical difficulties rec 1091 - <unassigned or new passcode> 1092 - <unassigned or new passcode> 1093 - <unassigned or new passcode> 1094 - <unassigned or new passcode> 1095 - Invalid 1096 - <unassigned or new passcode> 1097 - <unassigned or new passcode> 1098 - Reads back unit ID/line number, makes weird beep, hangs up 1099 - Invalid 1100 - Doesn't allow prompt recording, reads back unit ID/line number, call time, hangs 1101 - Disconnects 1102 - <unassigned or new passcode> 1103 - <unassigned or new passcode> 1104 - <unassigned or new passcode> 1108 - <unassigned or new passcode> 1109 - <unassigned or new passcode> 1110 - Doesn't allow prompt recording, invalid 1111 - Indian woman, "Hello world" 1112 - Doesn't allow prompt recording, hangs up? 1113 - Doesn't allow prompt recording, reads back unit ID, line number, recorded beeps (x2) 1114 - Reads back unit ID, line number, call time (local), prompts for 0 for live op 1115 - <unassigned or new passcode> 1116 - Invalid 1117 - <unassigned or new passcode> 1118 - <unassigned or new passcode> 1119 - <unassigned or new passcode> 1120 - <unassigned or new passcode> 1130 - <unassigned or new passcode> 1140 - <unassigned or new passcode> 1180 - <unassigned or new passcode> 1195 - <unassigned or new passcode> 1196 - <unassigned or new passcode> 1197 - <unassigned or new passcode> 1198 - Invalid 1199 - Call counts menu not available, invalid 1200 - Doesn't allow prompt recording, Invalid 1201 - Invalid 1202 - <unassigned or new passcode> 1203 - <unassigned or new passcode> 1210 - <unassigned or new passcode> 1211 - "Hello world... <digits voice> 2" 1212 - Invalid 1213 - Reads back unit ID/line number, prompts for APN, "We're sorry, there are currently no available calls (powells?). Please use the chat function within Gateway if you are scheduled to work. Or send an email via the support site for assistance. Thank you, goodbye." 1214 - <unassigned or new passcode> 1215 - No menu, reads back unit ID/line number, "Please enter your test ANI", Centralink outage reporting line 1216 - <unassigned or new passcode> 1217 - <unassigned or new passcode> 1218 - Test line, calling card delivery line, "Your calling card will be delivered to you in three to four years. Thank you for calling." 1219 - <unassigned or new passcode> 1220 - <unassigned or new passcode> 1221 - <unassigned or new passcode> 1222 - Invalid 1223 - Reads back unit ID, line number, "To test Spanish open, press one. To test Spanish closed, press two." 1224 - <unassigned or new passcode> 1225 - Invalid 1226 - <unassigned or new passcode> 1227 - <unassigned or new passcode> 1228 - Doesn't allow prompt recording, invalid 1229 - Allows blocked caller updating, invalid 1230 - Reads back unit ID, line number, "Welcome <# key>. "Enter the 10-digit mobile number <# key>" 1231 - <unassigned or new passcode> 1232 - <unassigned or new passcode> 1233 - Invalid 1234 - <unassigned or new passcode> 1235 - Invalid 1236 - No menu, hangs up 1237 - <unassigned or new passcode> 1238 - <unassigned or new passcode> 1239 - <unassigned or new passcode> 1240 - Invalid 1241 - <unassigned or new passcode> 1242 - No call counts menu, "Welcome to the final application. The unit ? and line is...", hangs up 1243 - <unassigned or new passcode> 1244 - <unassigned or new passcode> 1245 - <unassigned or new passcode> 1246 - Invalid 1247 - <unassigned or new passcode> 1248 - Allows blocked caller list updating, reads back unit ID, line number, call time (Unix epoch?), Asmanex order line 1249 - Reads back unit ID, line number, prompts for date, APN, says "Welcome" x3, goes to technical difficulties rec 1250 - <unassigned or new passcode> 1251 - <unassigned or new passcode> 1252 - No call counts feature, reads back unit ID/line number, test survey line 1253 - <unassigned or new passcode> 1254 - No call counts feature, invalid 1255 - <unassigned or new passcode> 1256 - Reads back unit ID/line number, "This is a test. Goodbye." 1257 - <unassigned or new passcode> 1258 - <unassigned or new passcode> 1259 - <unassigned or new passcode> 1260 - <unassigned or new passcode> 1261 - <unassigned or new passcode> 1262 - <unassigned or new passcode> 1263 - <unassigned or new passcode> 1264 - <unassigned or new passcode> 1265 - <unassigned or new passcode> 1266 - <unassigned or new passcode> 1298 - <unassigned or new passcode> 1299 - <unassigned or new passcode> 1300 - Doesn't allow prompt recording, invalid 1301 - <unassigned or new passcode> 1302 - <unassigned or new passcode> 1307 - <unassigned or new passcode> 1308 - <unassigned or new passcode> 1309 - <unassigned or new passcode> 1310 - <unassigned or new passcode> 1311 - Invalid 1312 - <unassigned or new passcode> 1313 - Doesn't allow prompt recording, allows caller blacklists, rings several times and disconnects 1314 - <unassigned or new passcode> 1315 - Doesn't allow call counting, reads back unit ID/line number, call time, "Hi, this is a test message!" + MOH, forwards to 402-517-6591 1316 - <unassigned or new passcode> 1317 - Reads back unit ID/line number, call time, prompts for date/time, day of week, test APN, # of calls, agents, goes to test GE queue 1318 - <unassigned or new passcode> 1319 - <unassigned or new passcode> 1320 - <unassigned or new passcode> 1321 - <unassigned or new passcode> 1322 - Reads back unit ID/line number, prompts for 10-digit APN 1323 - <unassigned or new passcode> 1324 - <unassigned or new passcode> 1325 - <unassigned or new passcode> 1326 - <unassigned or new passcode> 1327 - <unassigned or new passcode> 1328 - <unassigned or new passcode> 1400 - <unassigned or new passcode> 1411 - <unassigned or new passcode> 1444 - <unassigned or new passcode> 1497 - <unassigned or new passcode> 1498 - <unassigned or new passcode> 1499 - Call counter disabled, reads back unit ID, line number? Weird guessing game program? 1500 - Reads back unit ID, line number, call time (local time), "Press one for baseline application, press two for Chase Leisure application, press three for Chase Extras application, press four for national city application, press five for new PNC application" 1501 - Reads back unit ID, line number, University of Vermont smoking call-in study, wants five-digit ID 1502 - Reads back unit ID, line number, "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the Informix box, press five." 1503 - "Please enter your ID" 1504 - <unassigned or new passcode>? 1505 - Reads back unit ID, call time, "On this test call, press one to use the system date, or press two to change the date 1506 - <unassigned or new passcode> 1507 - <unassigned or new passcode> 1508 - <unassigned or new passcode> 1509 - <unassigned or new passcode> 1510 - <unassigned or new passcode> 1511 - <unassigned or new passcode> 1512 - <unassigned or new passcode> 1550 - <unassigned or new passcode> 1554 - <unassigned or new passcode> 1555 - Allows updating blocked callers, test survey line? Disconnects after greeting 2 1556 - <unassigned or new passcode> 1600 - <unassigned or new passcode> 1611 - <unassigned or new passcode> 1650 - <unassigned or new passcode> 1666 - <unassigned or new passcode> 1699 - <unassigned or new passcode> 1700 - Invalid 1701 - <unassigned or new passcode> 1702 - <unassigned or new passcode> 1711 - <unassigned or new passcode> 1740 - <unassigned or new passcode> 1747 - <unassigned or new passcode> 1748 - <unassigned or new passcode> 1749 - Reads back unit ID/line number, 402-555-3010 w/weird digits, call #, Office Depot IVR 1750 - Invalid 1751 - <unassigned or new passcode> 1752 - <unassigned or new passcode> 1800 - <unassigned or new passcode> 1811 - <unassigned or new passcode> 1850 - <unassigned or new passcode> 1900 - <unassigned or new passcode> 1989 - <unassigned or new passcode> 1990 - <unassigned or new passcode> 1991 - <unassigned or new passcode> 1992 - Has caller blacklist, invalid 1993 - <unassigned or new passcode> 1994 - Invalid 1995 - Invalid 1996 - <unassigned or new passcode> 1997 - Invalid 1998 - No call counts menu, reads back unit ID, line number, hangs? 1999 - Invalid 2000 - Invalid 2001 - Invalid 2002 - Invalid 2003 - Immediately starts recording (x2), makes weird beep, hangs up 2004 - Invalid 2005 - Invalid 2006 - <unassigned or new passcode> 2007 - Forwards to AT&T Wireless call queue 2008 - No menu, invalid, loops 2009 - Invalid 2010 - Call counts menu disabled, Community Care Rx member IVR 2011 - Reads back unit ID, line number, prompts for date, APN, 10-digit MDN (Cricket phone number), xfers to Cricket prepaid activation IVR 2012 - Reads back unit ID, line number, prompts for date, APN, 10-digit MDN (Cricket phone number), immediately tries to look up account info 2013 - <unassigned or new passcode> 2014 - No menu, AT&T Wireless IVR 2015 - <unassigned or new passcode> 2016 - <unassigned or new passcode> 2017 - Call counts menu disabled, reads unlabeled numbers and disconnects 2018 - <unassigned or new passcode> 2019 - Call counts menu disabled, "Hello, thank you for calling this test message. Goodbye." 2020 - Allows blocked caller update, weird beep x2 + hangup 2021 - <unassigned or new passcode> 2022 - <unassigned or new passcode> 2023 - <unassigned or new passcode> 2024 - <unassigned or new passcode> 2025 - <unassigned or new passcode> 2026 - <unassigned or new passcode> 2027 - <unassigned or new passcode> 2050 - <unassigned or new passcode> 2098 - <unassigned or new passcode> 2099 - <unassigned or new passcode> 2100 - Doesn't allow prompt recording, silence? 2101 - <unassigned or new passcode> 2102 - <unassigned or new passcode> 2103 - <unassigned or new passcode> 2111 - <unassigned or new passcode> 2150 - <unassigned or new passcode> 2210 - <unassigned or new passcode> 2211 - No menu, "Hello, this is a test call. Hello hello." 2212 - <unassigned or new passcode> 2221 - <unassigned or new passcode> 2222 - No menu, reads back 0166-052 + invalid prompt 2223 - <unassigned or new passcode> 2250 - <unassigned or new passcode> 2300 - <unassigned or new passcode> 2310 - <unassigned or new passcode> 2311 - <unassigned or new passcode> 2320 - <unassigned or new passcode> 2330 - <unassigned or new passcode> 2340 - <unassigned or new passcode> 2349 - <unassigned or new passcode> 2350 - *8 + xfer to Liberty Mutual IVR 2351 - <unassigned or new passcode> 2450 - <unassigned or new passcode> 2550 - <unassigned or new passcode> 2555 - <unassigned or new passcode> 2650 - <unassigned or new passcode> 2750 - <unassigned or new passcode> 2811 - <unassigned or new passcode> 2850 - <unassigned or new passcode> 2899 - <unassigned or new passcode> 2950 - <unassigned or new passcode> 2996 - <unassigned or new passcode> 2997 - <unassigned or new passcode> 2998 - Invalid 2999 - Invalid 3000 - Reads off unit/line #, disconnects call 3001 - Reads off unit/line #, poll line (billing test?) 3002 - <unassigned or new passcode> 3003 - Invalid 3004 - <unassigned or new passcode> 3005 - <unassigned or new passcode> 3006 - <unassigned or new passcode> 3007 - <unassigned or new passcode> 3008 - <unassigned or new passcode> 3010 - <unassigned or new passcode> 3022 - <unassigned or new passcode> 3031 - <unassigned or new passcode> 3032 - <unassigned or new passcode> 3033 - Invalid 3034 - Invalid 3035 - <unassigned or new passcode> 3044 - <unassigned or new passcode> 3050 - <unassigned or new passcode> 3100 - <unassigned or new passcode> 3133 - <unassigned or new passcode> 3150 - <unassigned or new passcode> 3310 - <unassigned or new passcode> 3311 - Hangs? 3312 - <unassigned or new passcode> 3333 - <unassigned or new passcode> 3433 - <unassigned or new passcode> 3999 - <unassigned or new passcode> 4000 - Test application w/indistinguishable speech 4001 - <unassigned or new passcode> 4002 - <unassigned or new passcode> 4003 - <unassigned or new passcode> 4004 - <unassigned or new passcode> 4044 - <unassigned or new passcode> 4096 - <unassigned or new passcode> 4097 - <unassigned or new passcode> 4098 - <unassigned or new passcode> 4099 - "Welcome to Centermaine power's administrative program. Enter your password during the six second silent interval." 4100 - "You are returning a call to an AT&T calling card network system, and the party that called you cannot be reached at this number." 4101 - <unassigned or new passcode> 4102 - Invalid 4103 - <unassigned or new passcode> 4104 - <unassigned or new passcode> 4105 - <unassigned or new passcode> 4111 - <unassigned or new passcode> 4200 - <unassigned or new passcode> 4300 - <unassigned or new passcode> 4321 - <unassigned or new passcode> 4411 - <unassigned or new passcode> 4444 - <unassigned or new passcode> 5000 - <unassigned or new passcode> 5100 - <unassigned or new passcode> 5200 - <unassigned or new passcode> 5250 - <unassigned or new passcode> 5299 - <unassigned or new passcode> 5300 - Doesn't allow prompt recording, allows blacklist updating, invalid 5301 - <unassigned or new passcode> 5302 - <unassigned or new passcode> 5303 - <unassigned or new passcode> 5330 - <unassigned or new passcode> 5340 - <unassigned or new passcode> 5348 - <unassigned or new passcode> 5349 - <unassigned or new passcode> 5350 - Invalid 5351 - <unassigned or new passcode> 5352 - <unassigned or new passcode> 5360 - <unassigned or new passcode> 5370 - <unassigned or new passcode> 5400 - <unassigned or new passcode> 5450 - <unassigned or new passcode> 5511 - <unassigned or new passcode> 5555 - Allows blocked caller list to be updated, won't allow prompt recording, invalid 6000 - <unassigned or new passcode> 6611 - <unassigned or new passcode> 6665 - <unassigned or new passcode> 6666 - Won't allow prompt recording, reads back unit ID, line number, 0317, prompts for test ANI + DNIS (Pepco outage reporting system) 6667 - <unassigned or new passcode> 6999 - <unassigned or new passcode> 7000 - <unassigned or new passcode> 7100 - <unassigned or new passcode> 7200 - <unassigned or new passcode> 7260 - <unassigned or new passcode> 7275 - <unassigned or new passcode> 7276 - <unassigned or new passcode> 7277 - Sends *8, transfers to Charles Schwabb queue 7278 - Reads back unit ID/line number, 711 number script 7279 - <unassigned or new passcode> 7280 - <unassigned or new passcode> 7300 - <unassigned or new passcode> 7400 - <unassigned or new passcode> 7500 - <unassigned or new passcode> 7600 - <unassigned or new passcode> 7700 - <unassigned or new passcode> 7777 - Invalid 7800 - <unassigned or new passcode> 7900 - <unassigned or new passcode> 8000 - <unassigned or new passcode> 8086 - <unassigned or new passcode> 8087 - <unassigned or new passcode> 8088 - Insurance IVR 8089 - <unassigned or new passcode> 8090 - <unassigned or new passcode> 8100 - <unassigned or new passcode> 8188 - <unassigned or new passcode> 8288 - <unassigned or new passcode> 8388 - <unassigned or new passcode> 8488 - <unassigned or new passcode> 8500 - <unassigned or new passcode> 8855 - <unassigned or new passcode> 8888 - <unassigned or new passcode> 9000 - <unassigned or new passcode> 9099 - <unassigned or new passcode> 9100 - Reads back unit number/line ID, psychic line 9101 - <unassigned or new passcode> 9102 - <unassigned or new passcode> 9103 - <unassigned or new passcode> 9104 - <unassigned or new passcode> 9105 - Card services IVR, refers to 888-998-3587 9106 - <unassigned or new passcode> 9107 - <unassigned or new passcode> 9108 - <unassigned or new passcode> 9109 - <unassigned or new passcode> 9110 - <unassigned or new passcode> 9117 - <unassigned or new passcode> 9118 - <unassigned or new passcode> 9119 - Doesn't allow prompt recording, reads back unit ID/line number, disconnects 9120 - Invalid 9121 - No menu, invalid, loops 9122 - <unassigned or new passcode> 9123 - <unassigned or new passcode> 9124 - <unassigned or new passcode> 9125 - <unassigned or new passcode> 9126 - <unassigned or new passcode> 9130 - <unassigned or new passcode> 9150 - <unassigned or new passcode> 9199 - <unassigned or new passcode> 9200 - <unassigned or new passcode> 9300 - <unassigned or new passcode> 9378 - <unassigned or new passcode> 9400 - <unassigned or new passcode> 9500 - <unassigned or new passcode> 9600 - <unassigned or new passcode> 9700 - <unassigned or new passcode> 9800 - <unassigned or new passcode> 9996 - <unassigned or new passcode> 9997 - <unassigned or new passcode> 9998 - Invalid 9999 - "Enter message number" 00000 - "Please enter your six digit password" 00001 - <unassigned or new passcode> 00002 - <unassigned or new passcode> 00010 - <unassigned or new passcode> 01990 - <unassigned or new passcode> 10000 - <unassigned or new passcode> 11000 - <unassigned or new passcode> 11100 - <unassigned or new passcode> 11110 - <unassigned or new passcode> 11111 - Doesn't allow call counter, "I'm sorry, you aren't allowed to use this service" 12345 - Invalid 20000 - <unassigned or new passcode> 22222 - Doesn't allow prompt recording, invalid 30000 - <unassigned or new passcode> 33333 - <unassigned or new passcode> 40000 - <unassigned or new passcode> 43210 - <unassigned or new passcode> 44444 - Doesn't allow call counter, invalid 50000 - <unassigned or new passcode> 51111 - <unassigned or new passcode> 55555 - Allows caller blocking, Invalid 60000 - <unassigned or new passcode> 66666 - <unassigned or new passcode> 70000 - <unassigned or new passcode> 77777 - Invalid 80000 - <unassigned or new passcode> 88888 - Informants practice program? 90000 - <unassigned or new passcode> 99997 - <unassigned or new passcode> 99998 - <unassigned or new passcode> 99999 - Does not allow running test program 000000 - Invalid 100000 - Does not allow prompt recording, reads unit/line number, call time, forwards to rep 100001 - Invalid 100002 - <unassigned or new passcode> 100003 - <unassigned or new passcode> 100004 - <unassigned or new passcode> 111111 - Invalid 222222 - Does not allow running test program 300000 - <unassigned or new passcode> 333333 - Immediately records prompt, 123456 - Does not allow prompt recording, invalid 999999 - <unassigned or new passcode>
  5. 2 points
    Seems to stop the tone when hitting 0 on MF, then hangs up. I will investigate more and edit. EDIT: Actually stops the tone upon any MF digits being pressed. Then hangs up.
  6. 2 points
    Great to see some new faces! Especially in this thread. 0051 is a DATU. 0037 is a 105-type test as I think it's officially called. I think the idea is they do trunk testing. In any case, press 2, #, etc to make it produce tones and noise. 0 commonly hangs up on those things. 407-238-6209,6238 - Elevators on hotel PBX (Nortel Meridian) 407-238-6214 - Modem on hotel PBX: CONNECT CentOS release 6.5 (Final) Kernel 2.6.32-431.29.2.el6.x86_64 on an x86_64 XetaCAS_22832_MarriottRoyalPalms login: 843-414-0052 - rec, "We're sorry, your telephone is temporarily out of order. There may be a receiver off the hook. Please check your main telephone and extensions. Charleston, South Carolina. 843-1. CHTN." 502-753-0021 - 17A announcement machine 502-753-0059 - IVR, "Please enter your home phone number" 504-648-0010 - 17A announcement machine
  7. 2 points
    800-940-0538 - "Welcome to Medscribe. Please enter your ID number, followed by the pound sign." 800-940-0588 - IVR, "Welcome to the Groupcast message distribution center. Please enter your pin followed by the pound sign" 805-544-0015 - University elevator? Try pressing buttons. 800-829-0314 - 711 number 512-328-5987 - Thingie on analog line w/WEIRD sounding tones 800-829-0129 - Weird Allstate test IVR, wants working DNIS to do anything interesting
  8. 2 points
    I've been using a toll-free scan to test a few different methods of doing faster, but still manually reviewed stuff. Here's the results so far: EDIT: Heh, forgot the prefix. It's 800-488. 0000 - Sex line 0001 - Ringout 0002 - Ringout 0003 - Ringout 0004 - Ringout 0005 - NWN recording, Insight - responds to DTMF 0006 - Annoying queue rec 0007 - Ringout 0008 - Ad 0009 - Call center w/Cisco doohickey 0010 - Easyreach NWN rec, 713-01SG 0011 - Business w/wrbly sounding hosted Broadsoft 0012 - Ad 0013 - Business w/Nortel PBX 0014 - Ad 0015 - IVR, Sketchy debt relief service 0016 - Reorder via SS7 0017 - Ringout 0018 - Reorder via distant end 0019 - Business w/Definity PBX, Audix 0020 - NIS via SS7 0021 - Sketchy order line? 0022 - Reorder via distant end 0023 - Ad 0024 - Ad 0025 - Sex line 0026 - Order line, goes straight to rep 0027 - Business, Enterprise Rent-a-Car, individual location 0028 - Fax 0029 - Business, "Financial Services Organization", Nortel PBX? 0030 - Reorder via SS7 0031 - Business w/Nortel PBX (Lenovo?), same PBX as 0029 (AT&T TF) 0032 - Order line, goes straight to rep 0033 - Ad 0034 - Ringout to VMB, Nortel PBX 0035 - Ad 0036 - NIS via SS7 0037 - IVR, Bi-Lo/Winn Dixie Reporting System? Prompts for project # for event 0038 - Ad 0039 - 5ESS line, fax (Cincinatti Bell Anydistance TF) 0040 - Immediately disconnects 0041 - Business w/PBX, number changed rec. Responds to DTMF. 0042 - Ad 0043 - Ad 0044 - Ad 0045 - Business w/wrbly sounding PBX 0046 - # cannot be reached from calling area rec 0047 - Tech support call center 0048 - Ad? Forward to 800-FREE-411 0049 - Ad 0050 - Wrbly IVR, Kraft-Heinz consumer center 0051 - Ad 0052 - Ad 0053 - Call center, goes straight to rep - customer service 0054 - Order line w/IVR, won't pull docs 0055 - Global Crossing invalid rec 0056 - Ad 0057 - Ad 0058 - Busy signal 0059 - Easyreach 800 0060 - Ringout 0061 - Business w/wrbly sounding Cisco PBX 0062 - Call center, customer service 0063 - Ad 0064 - Ad 0065 - Ad 0066 - Business w/wrbly Panasonic PBX 0067 - Reorder via SS7 0068 - Business 0069 - Ringout 0070 - Ad ?0071 - Qwest UM VMS? 0072 - Ad 0073 - Business 0074 - Business w/unknown PBX 0075 - Wrbly sounding IVR 0076 - Business 0077 - Ad 0078 - Ad 0079 - Business 0080 - Ad 0081 - Ad 0082 - Business 0083 - Busy 0084 - Ad 0085 - Business w/Cisco VMS 0086 - Fax 0087 - Ad 0088 - IVR, National telemarketting company 0089 - Business 0090 - Shitty sounding customer service IVR 0091 - Weird, recorded busy signal via distant end 0092 - Ad 0093 - Ad? Forward to 800-FREE-411 0094 - Ad 0095 - Sex line 0096 - NIS via SS7 0097 - MCI CBCAD 0098 - Weird NWN rec 0099 - NIS via SS7 0100 - Ad 0101 - Ad 0102 - IVR, order line, won't pull docs, spits out 1021 when rep comes on the phone 0103 - Singles line 0104 - NIS via SS7 0105 - IVR, <TTS engine> "Phone number restricted" 0106 - Singles line 0107 - Ad 0108 - IVR, PCCW calling card, terminates in foreign country 0109 - Promoworks IVR rec, "This number is not yet active. It has been reserved for project <individual digit readback> 8-3-8-8" 0110 - Business 0111 - Business VMB? 0112 - Singles line 0113 - Ad 0114 - Ad 0115 - Business w/unknown PBX 0116 - Ad 0117 - Mobile satellite NIS rec 0118 - Weird NIS rec, "Error 201" 0119 - Weird service unavailable rec 0120 - Ad 0121 - Global Crossing invalid rec 0122 - Ringout to other ringout 0123 - 4ESS toll-free DISCO rec 0124 - 4ESS toll-free DISCO rec 0125 - Ad 0126 - T-Mobile sub, 415-802-8282 0127 - Same as 0037 0128 - AT&T disconnected number directory assistance thing 0129 - Ring x2 to busy signal via distant end 0130 - Ringout 0131 - Global Crossing invalid rec 0132 - Ad 0133 - Ad 0134 - Caresource IVR 0135 - Worldcom NIS rec 0136 - AT&T toll 5E/DMS CBCAD rec 0137 - Ad 0138 - IVR, Order line, doesn't pull docs 0139 - Ad? Forwards to 800-FREE-411 0140 - Order line, goes straight to rep 0141 - Ad 0142 - Order line, goes straight to rep 0143 - Ad 0144 - IVR, order line, doesn't pull docs 0145 - Ad 0146 - "Thank you for calling. Goodbye." 0147 - Ad? Forwards to 800-FREE-411 0148 - IVR, order line, doesn't pull docs 0149 - Ad 0150 - Ad 0151 - Business 0152 - IVR? Too much packet loss to tell 0153 - "This number has been reserved for Promoworks, but it has not currently been assigned to a project." 0154 - Business w/Broadworks hosted PBX 0155 - Really sketchy survey 0156 - Ringout 0157 - Ad 0158 - IVR, Harris Teeter reporting system, prompts for project number for event 0159 - Business w/Asterisk 0160 - Ad 0161 - "Please transmit your AMCON order now" <2100 hertz tone, 1 in DTMF> (Qwest TF) 0162 - Ad 0163 - Ad 0164 - Ad 0165 - Sprint DMS-250 CBCAE 0166 - Ad? Forwards to 800-FREE-411 0167 - Mutual of Omaha NWN rec 0168 - NIS via SS7 0169 - Ad 0170 - Order line, IVR 0171 - Wrbly sounding Cisco PBX 0172 - CBCAD via SS7 0173 - Global Crossing invalid rec 0174 - IVR, voicemail check-in line, prompts for account # (Paetec TF) 0175 - NIS via SS7 0176 - Ad 0177 - Business w/wrbly sounding PBX 0178 - IVR, real estate property line 0179 - Southwestern Bell NIS rec 0180 - Ad 0181 - Morgan Stanley IVR 0182 - Qwest UM VMS? "The room number is still not valid. You are going to be disconnected." 0183 - Ad 0184 - Ad 0185 - Business w/PBX, unknown type. Mitel? (MCI TF) 0186 - Ad 0187 - Sprint DMS-250 CBCAE 0188 - Ringout 0189 - Ad 0190 - Ad 0191 - Business w/Cisco PBX 0192 - CBCAD via SS7 0193 - Ad 0194 - # cannot be reached from calling area rec 0195 - Reorder via distant end 0196 - Ring x1 to busy signal 0197 - Ad 0198 - Wrbly Anypath VMB for mobile phone, 917-515-5643 0199 - Ad 0200 - Business w/IVR 0201 - NIS via SS7 0202 - Ad 0203 - Wrbly sounding ringout to Panasonic AM 0204 - Business w/Comcast line, VMB 0205 - Ad 0206 - Forward to wireless Anypath VMB for order line? 0207 - Ad 0208 - Reorder 0209 - Wrbly sounding queue 0210 - Sprint DMS-250 CBCAE 0211 - Ad? Forward to 800-FREE-411 0212 - Reorder via distant end 0213 - Ad 0214 - Ad 0215 - Ringout to wrbly sounding queue 0216 - Call queue 0217 - IVR, order line, won't pull docs 0218 - Ad 0219 - NIS via SS7 0220 - Ad 0221 - IVR, order line, won't pull docs 0222 - Ad 0223 - Weird rec, "You have reached a number that is no longer active." 0224 - ACB via SS7 0225 - Business w/Cisco PBX, 10 digit extensions? 0226 - Ad 0227 - "This number has been reserved for Promoworks, but it has not currently been assigned to a project." 0228 - Ad 0229 - Call center/sales for sketchy old person thing 0230 - Business w/wrbly sounding PBX 0231 - Ringout 0232 - CBCAD via SS7 0233 - Ad 0234 - Ad 0235 - ACB via SS7 0236 - Ad 0237 - Ringout 0238 - Ad 0239 - Ad 0240 - Ad 0241 - Ringout 0242 - IVR, "Welcome to the Safeway Canada reporting system. Please remember to press the # key after each response. Enter the project number of the program you executed." 0243 - Ad 0244 - Ad 0245 - Ringout 0246 - Ad? Sketchy order line? 0247 - Busy signal 0248 - 4ESS toll-free DISCO rec 0249 - NIS via SS7 0250 - Ad 0251 - Global Crossing invalid rec 0252 - Call center w/analog lines 0253 - rec, "The offer for which you are calling is not yet available." 0254 - Qwest UM VMS?, "The room number is still not valid. You are going to be disconnected." 0255 - Sales/support IVR 0256 - Ad 0257 - Ad 0258 - Business w/PBX on DMS-100 line (Frontier TF) 0259 - Call center queue w/loud recorded ring 0260 - NIS via SS7 0261 - Psychic line? Gives free five minute reading (BH Telecom TF) 0262 - Ad 0263 - Ad 0264 - Ad? Forwards to 800-FREE-411 0265 - Ad 0266 - Ad 0267 - Call center IVR 0268 - Ad 0269 - Asterisk MOH for a second, routes to ad? 0270 - Busy signal 0271 - Ad 0272 - Ring + NIS via SS7 0273 - Asterisk NIS rec + weird readback + ringout 0274 - Reorder via distant end 0275 - Ad 0276 - Pat Fleet NIS, trailer '5E1' (GCI Communications TF) 0277 - Ad 0278 - Guy on cell 0279 - Woman on cell? "Call I help you?" 0280 - Ad 0281 - Ad 0282 - Ad 0283 - Ad 0284 - IVR, "Welcome to the Wakefern (sp?) reporting system. Please remember to press the pound key after each response. Enter the project number of the program you executed." 0285 - AT&T Easyreach 800 NIS rec, trailer 713-01SG 0286 - Ad 0287 - Ad 0288 - Business, ringout to AP or APMax VMB (ANPI TF) 0289 - Business w/NEC PBX 0290 - IVR, wrbly sounding pharmacy call center 0291 - ACB via SS7 0292 - Ringout 0293 - Business w/Cisco Callmanager 0294 - Ad 0295 - Ad 0296 - NIS via SS7 0297 - Weird reorder via distant end 0298 - Business w/IVR 0299 - CBCAD via SS7 0300 - Ad 0301 - DMS-100 ringout to Qwest UM VMB 0302 - Ad 0303 - NIS via SS7 0304 - Wrbly sounding call center 0305 - Call center 0306 - IVR, # reserved for client 0307 - Call center 0308 - Business w/DMS-100 line, Nortel key system 0309 - CBCAD via SS7 0310 - Ad? Forward to 800-FREE-411 0311 - Ad 0312 - Ad 0313 - CBCAD via SS7 0314 - Ad 0315 - Reorder via SS7 0316 - Ad 0317 - Ad? 0318 - Ad? Forward to 800-FREE-411 0319 - NIS via SS7 0320 - Business w/Cisco Callmanager 0321 - Ad 0322 - Ad 0323 - Business w/Avaya Partner PBX (Marchex TF) 0324 - Weird # not available from calling area rec (Intelemedia TF) 0325 - Ad 0326 - AT&T Easyreach 800 NIS rec, trailer 713-01SG 0327 - NIS via SS7 0328 - MCI tandem CBCAD 0329 - Reorder via distant end 0330 - Ad 0331 - Ad 0332 - Ad 0333 - Busy 0334 - Ad 0335 - Ad 0336 - Ad? Forward to 800-FREE-411 0337 - Ringout 0338 - Business w/wrbly PBX 0339 - Business w/IVR 0340 - Ad 0341 - Ad 0342 - Ad 0343 - Ad 0344 - Subscriber 0345 - Ad 0346 - Ad 0347 - Reorder via SS7 0348 - # cannot be reached from calling area rec 0349 - Global Crossing invalid rec 0350 - Ad 0351 - Reorder 0352 - Ring x2 + hangup 0353 - Callsource NIS 0354 - rec, "The offer for which you are calling is not yet available." 0355 - Ad 0356 - rec, "The offer for which you are calling is not yet available." 0357 - CBCAD via SS7 0358 - IVR, Qwest Update Center voice, "Welcome to the MeetingOne conferencing service. If you are the host, please enter your PIN and the pound key. Otherwise, please wait for the host's arrival." (MOH plays) 0359 - Call center IVR 0360 - Ringout 0361 - Business 0362 - Qwest UM VMS?, "The room number is still not valid. You are going to be disconnected." 0363 - Business w/PBX 0364 - Ad 0365 - Business w/PBX 0366 - Ad 0367 - Reorder via SS7 0368 - Ad 0369 - Cellular subscriber 0370 - Call center 0371 - Order line, IVR 0372 - Wrbly sounding debt collector 0373 - Ad? Forwards to 800-FREE-411 0374 - rec, "The offer for which you are calling is not yet available." 0375 - Ad 0376 - Ad 0377 - IVR, call center 0378 - Asterisk MOH to ad 0379 - Ad 0380 - Reorder via distant end 0381 - Qwest UM VMS?, "The room number is still not valid. You are going to be disconnected." 0382 - Ad? Forwards to 800-FREE-411 0383 - # cannot be reached from calling area rec 0384 - AT&T Easyreach 800 0385 - Ad 0386 - Weird sounding NIS rec, trailer MIA-8 0387 - Ad 0388 - Ad 0389 - Ad 0390 - NIS via SS7 0391 - Scammy vacation survey 0392 - Ad 0393 - Ad 0394 - Worldcom DMS-250 NIS rec 0395 - Weird sounding NIS rec 0396 - Order line, IVR 0397 - NIS via SS7 0398 - NIS via SS7 0399 - Ad 0400 - Ad 0401 - Qwest UM VMS?, "The room number is still not valid. You are going to be disconnected." 0402 - rec, "The offer for which you are calling is not yet available" 0403 - Reorder 0404 - Ad 0405 - Ad 0406 - Ad 0407 - Busy 0408 - TTS rec, "Phone service on this number has been suspended. You call is now being disconnected." 0409 - Ringout 0410 - Business w/Avaya Definity, Audix 0411 - Morgan Stanley office IVR 0412 - rec, "The offer for which you are calling is not yet available" 0413 - Ad 0414 - Wrbly sounding call center 0415 - Call center 0416 - Order line, IVR 0417 - Ad 0418 - Disconnects immediately 0419 - Ad 0420 - Ad 0421 - Weird FSK modem thingie for alarm systems 0422 - Ad 0423 - Ad 0424 - MCI tandem CBCAD 0425 - Reorder via SS7 0426 - Ring to wrbly sounding MOH 0427 - Ad? Forwards to 800-FREE-411 0428 - Business w/Cisco Callmanager 0429 - Order line, WOW Computer (lol) 0430 - Ad 0431 - Ad 0432 - Call center 0433 - # cannot be reached from calling area rec 0434 - Ad 0435 - AT&T toll 5E/DMS CBCAD 0436 - Business w/wrbly sounding Cisco Callmanager 0437 - Global Crossing invalid rec 0438 - Ad 0439 - Ad 0440 - Busy signal 0441 - NIS via SS7 0442 - Business w/Audix VMB, Definity PBX? 0443 - Ad ?0444 - Business w/PBX 0445 - Call center 0446 - Reorder via distant end 0447 - Ringout 0448 - Ringout 0449 - # cannot be reached from calling area rec 0450 - Ad 0451 - Business w/unknown PBX 0452 - Ad 0453 - Ring x1, disconnects 0454 - # cannot be reached from calling area rec 0455 - Order line, IVR 0456 - Business 0457 - Ringout 0458 - Ringout 0459 - NIS via SS7 0460 - Ad 0461 - Ad 0462 - Ad 0463 - DMS-100 ringout 0464 - Ad 0465 - AP NIS rec 0466 - Reorder via SS7 0467 - Ad 0468 - Ringout 0469 - Ad 0470 - Weird sounding NIS rec 0471 - Ad 0472 - Ad 0473 - Business w/Cisco Callmanager 0474 - Ad 0475 - AT&T Easyreach 800 0476 - Fax 0477 - Ad 0478 - Glenayre/Skytel VMS, prompts for PIN 0479 - AT&T Easyreach NIS rec, trailer 203-01SG 0480 - Morgan Stanley after-hours IVR 0481 - Business w/Ringcentral account 0482 - AT&T Easyreach NIS rec, trailer 713-01SG 0483 - Ad 0484 - Ad 0485 - Busy signal 0486 - Ad 0487 - Ad 0488 - Business w/NEC PBX 0489 - Ad 0490 - AT&T Easyreach 800 0491 - Ad 0492 - Ringout 0493 - Ad 0494 - Ad 0495 - Business w/Cisco Callmanager 0496 - McLeodUSA CBCAD 0497 - Business, ringout to Meatwitch VMB 0498 - Business w/PBX 0499 - Ad? Forwards to 800-FREE-411
  9. 2 points
    So I think I found a bridge that should work great; 510-940-0102. It's a ringout like all the rest, in an urban area so least cost routing won't be an issue, unused, and isn't going through any extra garbage. Barring any problems, this should be the last change.
  10. 2 points
    Sure! I had to go through this myself, only without the benefit of an account on the translations card to work with. Depending on what software release you have (if you're trying to install a C-LAN card, I assume it's a fairly late release. I don't think it'll work with anything below release 7) you have a few different options here. 1) The easiest is to just boot the system with no translations card installed. Once you've got it running, log into it with the username inads and the password indspw. Go ahead and insert the memory card into the reader. Or just skip all this crap and if you have something that accepts linear flash (ATA flash for the later systems) PCMCIA cards, just stick it in that. Anyway, assuming you're doing the Definity method, type 'upload translation'. Or maybe it's download; I think they made it to be upload from the Definity instead of to the terminal emulator. On one, it'll copy the flash card's contents into RAM and say "Prepare to receive file". Use xmodem to receive the file, and you'll have a copy of the passwords (albeit XORed or something; it's not anything particularly sophisticated. I don't know the algorithm, but I can give you as many plaintexts as you want if you need them. It doesn't seem to be anything standard, but it looks like Base64 at first glance) from the switch. 2) If you have a release 6 or lower processor, you can boot with no translations card again, and overwrite the bytes for the init (superuser; the one that lets you activate any feature you feel like having) password with the ones of a password you know (there's no RAM protection; the rva command should let you do this. I'll attach a ramdump of the pam process to this post). For added shits and giggles, there's even a byte you can change to make a password expire. In some situations, that might be the only way you have to change it. I dunno a lot about the way the header works, but in release 6 and 8, there's a byte that indicates what type of account the username is - or maybe it's an account ID. By default, It's 0x00 for init, 0x01 for inads, 0x02 for craft, and I think the rest are in descending order of account privileges. It might be possible to have two init or inads accounts. However, if the init account is set to prompt for an ASG login (which in release 8/+, it is by default), it'll try and give you a challenge/response for the init account. If you do have a release 8/+ translations card, one thing I've found you can do is change the account ID for the init account to 0x01 (so it doesn't prompt for an ASG challenge/response), write the password to one you know, and then write it back to 0x00 when you're logged in. Though you'll get slightly higher privileges than the inads account, it seems to know what you're doing, and disables the option to change purchased features. Or activate the switch to begin with >.< . For release 8/+, I think there's really only one course of action that can be done at the moment; log in as inads (or init with the above method; the only difference is under inads, it'll try to hide this, but it'll still accept it) and type 'go debugger local'. The switch has a lot of nice things in here, including a simple disassembler. If you speak R3000 assembly, you can probably figure out why/how the switch knows you've been screwing around with the accounts. Judging by how it complains about my *cough* modded release 6 card, I assume the init password is derived from something specific to the software version, and newer releases, knowing that, will complain if you've changed it. If you decide to take this route, lemme know. There's a bit more detail I can go into about the debugger and general Oryx/Pecos operation. 3) You can boot it with no translations card, and upload a fully unlocked release 6 translations backup I made to your card. On newer releases, this'll still work, but you'll be relegated to release 6 features, and it won't let you save; the newer processor releases seem to know something is up, and will claim the card is corrupted. Normally I'd just upload it, but there's some stuff I'd rather not have public on the translations backup I made. Lemme know if you want it. pam.bin pam_r8.bin
  11. 2 points
    http://www.digitalbond.com/blog/2013/10/22/call-yourself-a-hacker-lose-your-4th-amendment-rights/ Apparently saying that you like hacking on things without specifying "things" means you're automatically assumed to be compromising systems and that you're going to destroy evidence so they might as well take all of your equipment preemptively. So I guess hacking together a high water sensor for the basement, since I'm calling it "hacking," means I'll destroy evidence in legal investigations and that I like to break into systems I don't own all the time. Bullshit.
  12. 2 points
    It's basically what C.N.N. tells sheeple a "hacker" is. The average person doesn't know anything about technology, so they look at what Kim Komando (or other "technology experts") write on CNN and USA Today. Total rubbish! I mean, she says, "a hacker broke into Home Depot and stole peoples' credit card numbers. Bad hackers!". So... that's what people think; architects, mail carriers, police officers, and judges. Doesn't matter what they do for a living, if Kim Komando says its true, its gotta be true. However, if someone kept breaking into a bank's vault and stealing money that way.... They'd say, "crap my banks sucks. It needs a new vault and better security. Of course a burglar will sneak in and rob a bank if they leave the doors and vault unlocked or insecure".
  13. 1 point
  14. 1 point
    Hey guys, I've been reading this forum for about 8 years as a guest and I just joined as a member and I'm really interested in these strange phone numbers. I've saved a lot of my favorites over the years and I've started a subreddit over at reddit.com/r/weirdnumbers where I've posted a lot of them. The subreddit is open to new submissions and I've already put a lot of my favorites from this forum there, but if you guys have any others in mind, feel free to share them there as well And this is not just a promotion post for my page, I'm also interested in reviving this one with regular scans I'm going to be posting from now on. I love this forum and its a shame that this thread is mainly dead now because back in the day (2012-2015), I'd come on here every month and find tons and tons of new stuff. Let's make that happen again! ThoughtPhreaker, many of the best posts here and stuff I've shared at r/WeirdNumbers came from your amazing work and scans. You're an inspiration, man, keep up the good work and feel free to join the subreddit. Meanwhile, I'll be here waiting for more of your gems and hopefully posting some new ones myself! I finish off by posting a few of my favorites: All circuits are busy, chopped up message: 580-251-9131 Year 2000 Testing Number (odd): 212-255-9901 Hang up now: 212-251-9901 Live Feed of Fox News: 212-301-3799 Telephone Number, please try again: 516-626-9901 All Channels are normal: 310-347-3277 This number is IN service! : 303-651-0002
  15. 1 point
    I looked up how to hack fire alarm and the first site pops up like TA-DA!
  16. 1 point
    I haven't been able to find it again - but I know it was there... At the top of the page it simply said HACKERNET and then below it said "are you into computers, breaking into them, security, blah blah blah" and then went on to say that a group was being put together for like minded individuals --- send your info and we will make you part of our mailing list... For all I know it was an FBI sting or something.. I was young enough I sent my info (and then got busted in operation sundevil - but I dont think the two were related) but never heard another thing. I like collecting stuff like this... If anyone remembers the ad I would love to hear from you and maybe what mag it was from.. I *WANT* to say it was from "Computer Gamer" and likely around 1986...
  17. 1 point
    A friend of mine more into the computer side of things mentioned that there's some attacks based on strcmp (basically, a string compare function) and the amount of time it takes for the function to execute; basically, the function only executes until it finds a character that doesn't match. So for example, if you enter a password of 12345 but a computer is expecting 12335, strcmp will stop after the second three since no matter what, it's not going to match. So this got me thinking; in a TDM network, there's basically no varying latency once a connection is set up. A lot of IVR platforms like to return strings too, and strcmp is used very extensively for comparing them in exactly that circumstance. If you were to record the amount of time it took to compare passcodes, I'm willing to bet you'd see a tiny difference (as in, maybe a nanosecond or two) in how fast it responds with a recorder. So while if you have a nice network connection without any sort of packetization or anything this could be perfect, the flipside of this is there's a lot of IVR applications that are single threaded; basically, only one request executes at a time. So if someone else is using another channel on it, it might finish up their request before getting to yours. So this may be an attack that works significantly better late at night. EDIT: Heh, yeah,so it occurred to me that measuring nanoseconds over an 8000 samples/second medium might not be a good idea. Not that I'm still not going to see if there's any measurable difference in execution time.
  18. 1 point
    So I just finished up doing a basic run-through of beep tones for various voicemail and answering machines. Keep in mind if you're implementing this on something like Dialogic hardware and actually want to measure the time of the tone (you're awesome for going the extra mile if you do), you'll have to account for how long the voicemail system will listen for silence before waffling on with menu options or hanging up or whatever; it's not considered the end of a cadenced tone until it hears something else. Since this is user definable, I'd suggest testing with a nice average, like 9 seconds of silence after the tone with five second deviation (so 4 through 14 seconds of silence before it hears something else). Bear in mind too that if you're going to use any sort of IP trunking, packet loss is going to hamper performance quite a bit; if there's packet loss in the tone, it'll be considered two short tones instead of one long one. If there's packet loss concealment, it's going to stretch the samples out to an inconsistent length. Anyway, I'll probably update this with more stuff in time. Octel - 385 hertz, 250 milliseconds non-Dialogic Audix - 850 hertz, 480 milliseconds Anypath - 850 hertz, 400 milliseconds Dialogic DM3/HMP,JCT - 1000 hertz, 400 milliseconds (JCT is quieter, has non-sine waveform. There are a number of voicemail systems that're based on these cards and simply use the beep tones baked into the firmware) Avaya Aura - 1000 hertz, 380 milliseconds Newer NEC Univerge systems - 1000 hertz, 550 milliseconds Verizon Wireless VMS (Comverse?) - 1000 hertz, 200 milliseconds (this one is weird; it's composed of four studders that're each ~45 milliseconds long with 5 millisecond spaces. Whoever made this is stupid. Have your detector ready to account for this) Qwest/AT&T UM - 440 hertz, 140 milliseconds (sometimes it studders too, but this shouldn't hurt detection) APMax, AP? - 440 hertz, 280 milliseconds Comcast - 1650 hertz, 140 milliseconds Nortel Callpilot, key systems - 500 hertz, 550 milliseconds Ringcentral - 620 hertz, 300 milliseconds Google Voice - 585 hertz, 360 milliseconds Cisco Unity - 425 hertz, 500 milliseconds Metaswitch - 440 hertz, 150 milliseconds Newer Toshiba Strata - 790 hertz, ~480 milliseconds (this one fades out, so you may have to give whatever detector you're using some grace period; it probably won't hear the whole thing) Cox - 1400 hertz, 480 milliseconds Middle-aged Panasonic answering machines - 1040 hertz, 800 milliseconds Rolm Phonemail - 950 hertz, 125 milliseconds GTE (custom Glenyare?) - 1330 hertz, 400 milliseconds Stock Glenayre - 1400 hertz, 240 milliseconds Shoretel - 2000 hertz, 200 milliseconds ESI - 620 hertz, 395 milliseconds Newer Panasonic answering machines - 1000 hertz, 420 milliseconds Older (late nineties to mid 2000s) Panasonic answering machines - 1000 hertz, 1000 milliseconds Older Intertel - 650 hertz, 220 milliseconds Newer Mitel Express Messenger/Nupoint systems - 795 hertz, 380 milliseconds (like the newer Stratas, this one fades down) Middle-aged Toshiba Strata - 440 hertz, 490 milliseconds (this one fades *in* for...reasons) Older Centigram/Mitel Nupoint systems (same thing) - 1000 hertz, 200 milliseconds Some Comdial systems (mid-nineties or so) - 650 hertz, 500 milliseconds (this one fades down) Some Avst systems - 1000 hertz, 450 milliseconds T-Mobile - 1000 hertz, 200 milliseconds
  19. 1 point
    Adding another from NANPA - the toll-free (800/877/etc) carrier list and which carriers claims what. 800855_Assignments.pdf
  20. 1 point
    There's always been little slip-ups in the way AT&T restricts 800 numbers from 101-0288-0, for anyone old enough to remember that. But more recently, they've been doing some sort of weird call distributing technique; for example, if you're in one of these affected areas, they'll distribute calls to different OSPS switches throughout the country. Something about the trunk group you come in on instructs the network to allow 800 calls out from OSPS again from these areas. If you're around any of these areas, I've confirmed with some friends that it'll work: Washington, DC San Francisco, California Ontario, California Fresno, California Muskegon, Michigan Oberlin, Ohio Cincinatti, Ohio Lincoln, Nebraska Orlando, Florida Tampa, Florida Manchester, New Hampshire Denver, Colorado Dickinson, Texas Des Moines, Iowa Springfield, Massacheusetts Chicago, Illinois Rolla, Missouri Kansas City, Missouri Fargo, North Dakota As always, toll-free calls through the Honolulu and San Juan OSPSes will go through like they always have. There's also a few interesting scenarios, like tiny LECs with direct trunks to OSPS, where toll-free traffic has always gone through.
  21. 1 point
    206-204-6198 - Dialtone via ? 416-640-0468 - Dialtone via thingie. Likes to generate offhook tone for presumably invalid numbers. 206-576-7201 - Room monitor. At parking garage? Awesome reverb. 612-349-4045 - Definity conference bridge. On a hotel PBX. For...reasons. 612-349-4077 - rec, "Hello, this is your wakeup call. Today is Saturday, August 12th. Today's weather is partly cloudy with a high of 81 and a low of 59. Thank you so much for staying with us here at the Marriott City Center and have a wonderful day." 612-349-4017 - Modem 612-349-4031 - 300 baud modem 612-349-4072 - Modem 612-349-4073 - Modem 612-349-4096 - Modem 847-954-7205 - Modem 847-954-7095 - Room monitor. In switchroom? 847-954-7093 - Modem 847-954-7041 - Ringout bridge 847-954-7011 - Modem 847-954-7506 - Ringout bridge 847-954-7512 - Ringout bridge 847-954-7599 - Time and temperature announcement, has weird, dying old people ads 847-954-7731 - Modem 847-954-7799 - Ringout bridge 970-547-4098 - Modem 970-547-4096 - Modem 970-547-4092 - DISA on Definity PBX
  22. 1 point
    I have some old GTE phone systems manuals. If I ever get around to scanning them, I'll upload them somewhere. GTE Telephone Operations: General HI-CAP Maintenance Uploaded to The Internet Archive.
  23. 1 point
    Awesome! Thanks very much. I didn't realize it was turned into an ezine after a physical run of 10 issues. This helps a lot. If anyone is getting rid of hard copies, I'm still interested.
  24. 1 point
    I've been working a little bit with the Definity today, and thought an update would be warranted: So through some quick trial and error and comparing to older releases, I was able to find the 2560 byte blob that is the license file in the translations, an identical copy stored in RAM by the fg_mapa process. Strangely enough, there seems to be some sort of redundant copy of this around somewhere; if you start manipulating the copy in fg_mapa and tell the switch to test the license, it'll very quickly change it back to what it should be. Thankfully, the switch comes with some very nice debugging utilities that should make figuring out where it's getting another copy to fix this (it isn't the translations card; I tried pulling that out. Though obviously, if you corrupt the copy on the translations card, it's going to have a much harder time getting another copy from RAM when you reboot. This helped verify a lot of this) a lot easier. There's going to be a few things to consider here, like how an actual license file differs from what the Definity stores (you're supposed to be able to paste it in using the ossi interface on the switch. The Definity won't accept the license you pull from RAM, however), but all in all, this should make the rest of the process a lot less painful.
  25. 1 point
    welp.. i've been working on three projects for a bit and am along far enough to mention them... http://www.wardialers.org - will be the largest collection of wardialers, ld code hackers, vmb hackers, telenet scanners, scene transfer software, underground bbs software and more that has ever been compiled for 8/16 bit computers. DOS/Windows stuff may come later but that is not my focus right now as you can find that stuff anywhere. 8/16 bit stuff is starting to get lost and I am going to ensure that doesnt happen. http://www.8bitunderground.com - discussion of old school phreaking as well as the apps used.. maybe not too interesting to most people on binrev - who knows? http://blog.8bitunderground.com - rants and humor that surround the underground scene and technology in general. I have an absolute SHITLOAD of stuff to add to wardialers.org so please bear with me - but the site is open for business so to speak.. doc
  26. 1 point
  27. 1 point
    Hello everyone, I recently had a good friend move to the Cook Islands, and internet data is VERY expensive over there, so a traditional VoIP app like WhatsApp or Skype is still going to cost her a lot of data. My question: is there a way to initiate a call on my end in the United States via some type of VoIP app or something similar and make the call to her mobile phone or landline in the Cook Islands without incurring a charge on my end or her needing data on her end. I have found in my research a few such options for calling lines in larger countries, but nothing for a country as small as the Cook Islands. I figure you guys are probably the most knowledgeable bunch on the planet when it comes to phones so I thought it couldn't hurt to ask here. Thanks in advance for any help!
  28. 1 point
    8797 goes to CVS Helpline, 0102 from here goes directly to CVS Security. also 8798 to cvs caresomthingoranother, 8027 is some other pbx or something, then 0102 is the conference line.
  29. 1 point
    So earlier today, I happened to call a CVS Pharmacy, and out of sheer boredom, started hitting options that weren't listed on the IVR. As luck would have it, 8+xxx will transfer you to a three-digit extension in the store! The few constants I've noticed from a quick, cursory glance are 4xx go to IVR extensions, 500 prompts you to log in - presumably to voicemail, and the lower extensions seem to be for in-store stuff. 100 pretty consistently goes to a fax. If you happen to have a "friendly" neighborhood CVS near you, be sure to give them a "friendly" phreak welcome .
  30. 1 point
    866-862-4867, I don't know a passcode. - A conference bridge
  31. 1 point
    Go to https://www.ckts.info sign up there, ask on the mailing list how to connect via direct SIP, then dial to a bridge number for the PSTN, then dial to the bridge. ---OR--- SIP to Project MF ( http://projectmf.org/intro.html ), use a bluebox to dial KP-2602-ST and dial into the bridge
  32. 1 point
    Hello, my name is Zio, Im new as hell and dont know shit. Looking forward to figuring things out. \../
  33. 1 point
    Hey guys there is this app called Redphone by whisper systems that will encrypt calls using zrtp encryption. Its Free. http://www.whispersys.com/
  34. 1 point
    What are some Linux desktop application you cannot live without? I am really amazed at how Linux has come over the past few years as a desktop operating system! No more than 5 years ago I had to run OSX to get the best of both worlds: a decent core computing platform with good productivity tools. However, in the last few years it is now a reality: Linux easily can match MacOS as a productive desktop platform. So apps making this possible for me: Productivity: - LibreOffice or OpenOffice - Google Keep (Chrome App) - Simple Note - Makagiga (todo manager a little more robust than what Google Keep can offer) - Draw.io (chrome app) pretty polished, robust and free diagramming app - Journey (Chrome App) Journal app that is pretty polished - Caret polished cross-platform markup editor (simplenote just too many features for professional use) - Dropbox is cross-platform and the free storage plan is good enough to sync important files across systems Development: - JetBrains IDE's PHPStorm, WebStorm, and Pycharm (community) - Komodo Edit - offers a code runner, RegEx Toolkit and HTTP Debugger. Pricey but every few years it will go on sale for about 99 us - SublimeText - worth 75 bones for me. Atom just takes too long to load. - RazorSQL - about $99 for a cross-platform SQL swiss-army knife. - MySQL WorkBench - Virtual Box - VMWare Workstation (this supports level-1 nested hypervisors better for learning Hyper-V and vSphere) - CMD tools of course is where Linux is a powerhouse: phpbrew, Python, GIT (dropbox works well for small repositories :-) ), Vagrant, PHP, MySQL, etc... - Leptop code snippet manager Web / Internet / Networking - Chrome - Firefox for its dev extensions - HexChat - FileZilla - WireShark (duh) - nLoad - nTop Media: - VideoStream (Chrome Plugin for streaming to Chromecast) - Gimp - VLC - Pix image viewer
  35. 1 point
    Yup, the newer cards are ATA flash. The older ones (release 8/-), linear. If you don't want to bother with finding something to plug it into, the Definity can xmodem it to you. Boot it with no translations, log in as inads, plug it in, and type upload (I think. It's relative to the direction of the Definity) translations. Anyway, as for where to start, I'd get the switch to print a copy of the license data - list config license, I think. Then, with the system booted, if you have inads access under normal circumstances, get a ramdump of pam and compare it to a dump of the same process with no translations card installed. If that's not possible, just the latter is probably fine; the translations card will probably give most of what we need. The challenge with that, if we want to try and load/edit licenses through the memory card (obviously a great start. I'd really like to know where it's supposed to load this stuff in, though), is that it uses some weird format with a bunch of checksums. Ostensibly the best way to deal with that is to use the bulletin board feature; you could just write a 1 or something to it, upload the translations somewhere, then change it to a 2 or 0 or whatever, and see what changed.
  36. 1 point
    Sure, but keep in mind that the one time password algorithm for the Definity is based on DES. I'm not a crypto guy, but based on what I know about DES, having faith in that even if an attacker doesn't have the keys seems like a dangerous game. Much like the passwords as well, the ASG keys for init and inads are probably the same for every processor using a specific build. Though I guess the problem with that is you don't know what build it is until you log in or physically look at the sticker on the processor. This'll definitely have to be explored further at some point - maybe they use the same inads or craft or whatever key on every build. Ostensibly, yeah. The header and object files we got from the RPM should allow anybody who uses it in their code to encode and decode license keys, and from the look of the functions, probably make and test valid ASG keys as well. The idea behind disassembling the object files was to try and get an idea of how the functions work - and that's still a valid choice, but it might be less work to just use them as is through trial and error. Of particular note in asg.h is this: struct lic_info { unsigned char version[4]; unsigned char filler[6]; unsigned char hexkey1[8]; unsigned char hexkey2[8]; }; along with the four functions in license.h . Since gewt has a switch with a valid license, I was hoping we could use this to test data we know for sure works against anything we happen to write with these ASG functions. Sure! I'll send you a PM.
  37. 1 point
    I doubt it. You'd probably see the debugger command in there if it was doing that. From there, you can manually invoke the xmodem process, but I have no idea what sort arguments it wants. Every time I've tried, it just immediately kills itself. In any case, firmware updates for cards or translations and whatnot are typically what it's used for via the upload and download commands. You probably could; the only time it's ever bothered me about that sort of thing is when a process crashes, but there's easier ways to fool it. The real problem is under most translation cards, the inads user will prompt for ASG. You're fine if you boot the system with no card, but then you need to be able to feed it a license. That should be in the translations file. Using what we have in the ASG development headers, figuring out exactly what's going on shouldn't be too hard once we identify where the license is. Keep in mind it's designed explicitly for the product ID in the translations card, and probably the serial number on your CPU card though.
  38. 1 point
    I think it's all stored in the place you described. There's a PIN if I'm not mistaken, that brings it up to 20 hex bytes right next to the key in question. You'll see that particular set of bytes change every time you change your key. It's less big than you might think . Some people with Avaya PBXes are less than responsible, and put development packages on the internet: ftp://ftp2.veracomp.pl/net/avaya/Software/SES_5_1_2/Releases/rpms/asgtools-1-0.AV10.i386.rpm ftp://ftp2.veracomp.pl/net/avaya/Software/SES_5_1_2/Releases/rpms/asgtools-devel-1-0.AV10.i386.rpm While you can't get the source, you can get some header and object files used for ASG functions in their x86 platforms. They're relatively readable with a trip through a decompiler and some deducing which variables are which ( http://pastebin.com/c6znKRUF ), but more importantly, it shows that the earlier ASG stuff is a one time password algorithm based on DES. At some point - probably in the mid 2000s, they got enough sense in their head to switch to AES. This is important not just because the one time passwords are annoying/used to lock down the switch, but because release 10 and up, where all the really fancy features come into play, want you to upload a license key based on ASG. Yeah, I think the IP media processor won't work without a relatively recent release; ftp://ftp.avaya.com/incoming/Up1cku9/tsoweb/media/minhardwarevintages.pdf . If your release is 7.1 or something though, allegedly you can put this crazy thing in your switch and get IP trunks. Though it's sorta like adding a car to your pool because you don't like getting rained on while you swim. http://www.ebay.com/itm/Avaya-Lucent-Definity-TN802-V2-MAPD-Board-w-8MB-Card-HDD-/391312141904?hash=item5b1c056e50:g:atcAAOSw5VFWOpHM That depends on what you can get to work. You absolutely do need to use that software with a Dialogic card, but they make T1 cards too. I'd be surprised if Avaya didn't put support for that into their software. I think there's something to differentiate between analog and digital interfaces in the software. But then again, I tried it with my Dialogic T1 card and it didn't want to cooperate. Though I think that was probably a good thing in the long run. It wound up being used for...better things. http://thoughtphreaker.omghax.ca/audio/ligatt_megaphone.mp3
  39. 1 point
    OK, now on to something more complex, the challenge response mechanism for ASG logins. Not sure if this should be a new thread, let me know. The basic sequence is when you try to login to, say init, which is ASG protected, the system gives you a challenge number and wants a response. Here's the back story: When your account is created on the Definity, a secret key, is either machine generated or manually input for your username, (or init, or whatever). Both you and the definity know that secret key. When you try to login, the definity gives you a number that you have to run through the algorithm with your secret key, either on a hand held device or the management software. The resulting number is what you enter for the response to the Definity. Of course, it is doing the same. The response you give it must agree with what it generates internally so that it will let you in. Hope that makes sense. So where is the per username secret key stored? In the username record in PAM or somewhere else? I've read that it is either 14 hex or 20 octal digits. And the response is 7 digits(?). The secret key is displayed on the change login screen if you have high enough privilege to see it. On to poking around in memory.... After looking through the R8 Pam file you have attached to this thread, I've noticed something different about the 2 init records. There's the one at 264d0. If you look at the one at 38f60, there is an additional 16 digit hex string at 38f66. Could that be the secret key??????? If it is, all we need is the encryption algorithm!!! (Like that's a tiny thing!)
  40. 1 point
    rva is pretty straightforward to use; type rva process [whatever process you want to look at. For example, pam] a [address you want to dump. Though it's hex, it doesn't want a preceeding 0x before it] c [number of bytes you want printed out in hex format; for the maximum, 255, you'd tell it FF] The virtual memory addresses we want to look at always start at 0x400000. In the case of release 6, the init password is stored in a couple of places. The first is 0x423487, and since the password data is 12 bytes long, which is the value C in hex, you'd want to type: rva process pam a 423487 c c . There's also another address it's stored at; 0x435537. This one, I think (though I could be wrong. You could definitely try both if you're interested, but you can just log in and change it anyway) is the one it actually checks when you log in. As usual it's C bytes, but wva wants an extra argument; v/value. If you want to write different bytes, you'll have to do it one at a time, like wva process pam a 435537 c 1 v 00. If you want to overwrite everything, you could increase the count, and give it something like wva process pam a 435537 c c v 00 . Anyway, there's also a debugger command that lets you dump RAM. This is best for dumping the whole process. While you can use a script or something to spit everything out with the rva command, it takes a painfully long time to cough out even the smallest things. This, by contrast, should get pam (220 kb) in about ten minutes or so. Not exactly amazing, but it's more what you'd expect from a 9600 baud serial link. So just type, for example, rd -f (number of bytes you want)x pam 0x400000 , and it'll do the rest. The x indicates we want the bytes in hex format, rather than something horrible like octal numbers. The count can be as high as you want; it'll just keep going until the end of the file before throwing an error at the end. Just for the sake of completeness, here's a valid example command: rd -f 2000000x pam 0x400000
  41. 1 point
    At this point, you could probably just log in using the craft account; the password is "y0urthe1". I'm surprised; it actually only took a few hours to figure out. Let me explain how it works; it's actually pretty funny. So go ahead and boot your Definity without a translations card, and we can get started. As before, log in with inads, but this time type 'go tcm'. From here, you'll see a new, and from the looks of it, very, very nifty shell once you've gotten you're switch running with no restrictions. If you type klog, you can see a printout like this; support your local Oryx (Oryx g4.34)$ support your local Pecos$ Boot image vintage: G3V8i.02.0.034.5$ Boot image build information: 03/21/00-21:39:28;gaz;fld;alawint;G3V8.pj$ If you're not familiar with Oryx/Pecos, Oryx is the kernel, and Pecos is a series of processes that runs on top of it. But back to the password thing, if you're looking to do a lot of comprehensive work with the password file on the switch, you should do a full dump of the RAM allocated to the pam process. But that's kind of a big pain in the ass. If you're just looking to get the passwords, the switch actually makes it relatively easy. At the TCM shell, type this; prec pr_login nread_prec 0 And it should come back with something like this; PR_LOGIN 696e 6164 7300 006c 756a 6521 7376 6a2e 'inads luje!svj.' PR_LOGIN 0000 006c 756a 6521 7376 6a2e 0000 0001 ' luje!svj. ' PR_LOGIN 0101 0101 0001 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0100 0000 0000 0000 0101 0101 ' ' PR_LOGIN 0101 0100 0000 b21a 22c3 69b8 786c 0000 ' " i xl ' PR_LOGIN 0000 0000 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' See? It even gave us a little ASCII printout! Wasn't that nice of it? It'll ask you to press enter a few times before giving you the passwords for all users. So once you've got it, you'll probably notice a few things. For one, there's a lot of exclamations in the password file. Secondly, the dadmin account will probably read something like this; PR_LOGIN 6461 646d 696e 0021 214b 5621 5953 2121 'dadmin !!KV!YS!!' PR_LOGIN 2121 2121 214b 5621 5953 2121 2121 2101 '!!!!!KV!YS!!!!! ' PR_LOGIN 0101 0101 0101 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0200 0000 0000 0000 0201 0101 ' ' PR_LOGIN 0101 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' So why so many exclamation points? The exclamation point is a null character as far as the passwords are concerned. The byte I highlighted in bold is the one responsible for the user ID. So I'm going to change the password for craft from crftpw to crftpw1 and re-run the TCM shell command. There's a byte you can change in the RAM to make it force you to change your password. It's good in a situation like this where the switch won't let you change your password normally. It's sort of a pain in the ass to find, but let me know if you want me to point it out. Anyway, you'll notice the first two lines just changed to this; PR_LOGIN 6372 6166 7400 006c 7577 7231 636e 2121 'craft luwr1cn!!' <-- crftpw1 PR_LOGIN 2121 216c 7577 7221 636e 2121 2121 0001 '!!!luwr!cn!!!! ' <-- note old password stays the same (crftpw) This would be a good time to mention the Definity has two copies of your password, as you've no doubt noticed. But the old one stayed the same in this case, as far as I can tell, to enforce the password policy. Namely so that when your password expires, you can't just change it back to the old one. So what changed? Just one character - the 1 at the end. And sure enough, one of the null characters changed to a 1. Obviously though, it's not just as simple as scrambled characters. So next, let's change the password to aaaaaa1. PR_LOGIN 6372 6166 7400 007a 7a7a 7a31 7a7a 2121 'craft zzzz1zz!!' <-- aaaaaa1 PR_LOGIN 2121 216c 6977 7237 636e 2121 2121 2101 '!!!liwr7cn!!!!! ' <- crftpx2; I did a little trial and error before doing this. Notice the position of the 1 stayed the same. So at this point, it's obvious they're just substituting one letter (or number) for another. I'll save you some time here, and just say since a translates to z, b is x, c is c, d = v, e = b, and f = n. So with that in mind, let's figure out how this stupid byte swapping trick they're doing works. 5624713 efbd6ac PR_LOGIN 6372 6166 7400 0062 6e78 7639 7a63 2121 'craft bnxv9zc!!' <-- abcdef6 PR_LOGIN 2121 216e 6e6e 6e39 6e6e 2121 2121 2101 '!!!nnnn9nn!!!!! ' So there you go. First is the fifth password character, then the sixth, second, etcetera. Cute. So when encoding... a = z, b = x, c = c, d = v, e = b, f = n, g = m, h = a, i = s, j = d, k = f, l = g, m = h, n = j, o = k, p = l, q = q, r = w, s = e, t = r, u = t, v = y, w = u, x = i, y = o, z = p, 1 = 1, 2 = 7, 3 = 2, 4 = 8, 5 = 3, 6 = 9, 7 = 4, 8 = 0, 9 = 5, 0 = 6 For uppercase characters, the same concept applies; A= Z, B = X, and so on. So here's something I've been waiting to see for a long time. Let's pull up the record for the init password. PR_LOGIN 696e 6974 0000 0065 3132 3265 6a68 2121 'init e122ejh!!' PR_LOGIN 2121 2165 3132 3265 6a68 2121 2121 2101 '!!!e122ejh!!!!! ' PR_LOGIN 0101 0101 0101 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0001 0101 ' ' PR_LOGIN 0101 0100 0000 7de9 d15e 9ce8 a068 0001 ' } ^ h ' PR_LOGIN 0000 041b 0000 000c 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' Using the concept we just talked about, we can infer that the default init password is n3m3s1s. So just to check, I changed the craft password to n3m3s1s; PR_LOGIN 6372 6166 7400 0065 3132 3265 6a68 2121 'craft e122ejh!!' <-- n3m3s1s; same as init password. Lulz. PR_LOGIN 2121 2143 5670 5836 6f5a 2121 2121 2101 '!!!CVpX6oZ!!!!! ' Can you say insecure? The Definity can! Or as it'd say, ctjbwse12b2! . If you'd care to learn the order of the remaining bytes (that's the maximum length of 11 characters), that's "insecure133". EDIT: I talked with Chronomex earlier, and she pointed out that the characters map to the keys on a Qwerty keyboard backwards. Somehow Nortel got the idea this substitution cipher/byte swapping thing was a good idea too, so you'll see the something like it on Meridians. There's actually an NES game that did a better job at this. https://www.reddit.com/r/TreasureMaster/comments/9iyaf/we_have_our_first_breakthrough_courtesy_rj45_and/
  42. 1 point
    This thread made me wanna call a CVS as well, so I did just that. I spoofed the main number as my number and was placed inside some kind of VMB that wanted me to enter my password, no idea how their password system works.
  43. 1 point
    Y'know... That CVS on the corner is always pretty quiet. And I have new cell phone service to try out...
  44. 1 point
    I don't know enough about where affiliate partnerships end and begin in public radio, but the station is owned by New York Public Radio, not NPR itself. Certainly it'd be worth at least sitting down with them? Or even one of the locally owned commercial AMs. The show fits a talk format, and a lot of them are definitely open to new ideas to raise value for the property. They could use some help getting up there on the PPM scale. I wonder if the hardest part has actually been getting anyone to talk to them. What with WBAI's reputation for airing conspiracy shit, they might stop reading the second they see that name.
  45. 1 point
    Pirate since 14 , got mine at 16. Now i hold the equivalent to the extra or general class in my country. Lots of fun in and out of amateur bands. There is plenty of stuff to hear on. My latest interest are psk31 and listening to utility stations.
  46. 1 point
    Avoiding corporate espionage.
  47. 1 point
    Am I the only person that never had ME bsod? I had an ME box for a solid 3 years, unfortunately, but it didn't give me too many problems. XP wins pretty hard, I keep it installed on this box, I'm currently posting this from my Debian install. I use both windows and linux on a regular basis. Vista can suck my cock. It is complete failsauce, I have nothing more to say about that. Both operating systems have their strengths and weaknesses, I keep both of them around for this reason. Just because you're "UBER FUCKING 1337" (read: fat and live in a basement) and Bill Gates is a n00b, (read: filthy rich, with a nicer basement than you) doesn't mean windows is a complete failure. If anything you should applaud MS for their powerful propaganda machine, they manage to move their products into many households, and they get people to pay for frequent upgrades. MS sells software like Hitler killed Jews, efficiently.
  48. 1 point
    Just a couple of notes about the cut today in Wawina (It is spelled Wawina) 15:12, the last cirucit was cut over to T1 about 17:15 we pulled the breaker on the N2 system. It's beleived to be the last N2 system. Alaska may or may not be N2, it's SF for sure, but could be radio (Mircowave or Sat). If it is N2 It's probably Lynch and not WECO. I have pictures of the Wawina end of the N2 which I'll put online sometime soon. I was able to see the Grand Rapids end, but photos are not allowed in a Qwest office without a note from Ma Bell. 1306/1307 are gone for good. I've moved the recordings to 2600 as-is for now. Later, I'll have an introduction from Bob or myself that talks about about the history and the cut. I'll also put up the sound files sometime soon from 1307 and maybe from the conferences that I recorded. Thanks to everyone who helped get the word out and to everyone who called and played with it. I'm glad I was able to provide an "Old Skool" playground for those who have never had a chance to play with 2600 signalling. Our goal is to get this equipment shipped to the Telephone Museum out east and hopefully they will get it back online and working. I don't normally hang out here, so if you want to get in touch, email me or leave a message for me on 1313. It was a good system while it lasted. N2 Wawina MN 1972-2006 RIP --Shane
  49. 1 point
    Yes, but the whole point is that linemen ARE NOT SWITCHMEN. There's a bureau equivalent to the north american telcos' RCMAC (Recent Change Memory Administradion Center) which handles that. ← i still think that rcmac sounds like a rapper, or maybe a gangster. "Yo dis r-c-mac, dialin up an anac, got my beige box in my backpack, i got sbc and pa-cific bell, fuck wit da switch, and dey'll send ya staight to jail, but shh dont tell, when i bust out my diala, oparata's be phjeerin, stick it to da mic, dis is what chall hearin (plays dtmf) YOOOOOooo"
  50. 1 point
    Bear in mind that a lot of area codes, mine included, are in the form of 01xxx xxxxxx, or in some places (one in my area code for example) 01xxx xxxxx. the 01xxx xxxxxx is something like 999999 numbers, but 0xxxxx and 1xxxxx are probably reserved because service codes exist on it. In my area, 5xxxx 6xxxx 7xxxx are the local town, 8xxxxx are the outlying villages, the town again, and VOIP, 9xxxxx doesn't exist because of 999. I doubt you could dial into a switch nowadays, (there are probably people who could prove me wrong on this, Fone Ranger probably), as BT would have them connected to some internal network not accessible by the PSTN where they can configure their switches. Engineers could use a GSM/GPRS card in a laptop whereby they could access BT's network and configure that way if they needed to (again, I don't know enough about the BT network today to tell you fact). There was a page detailing the BT network from phone to exchange, and BT wholesale has a good section on how its PSTN, ADSL, SDSL networks operate.