

               < The Israeli Underground Information eXchage >

                   ,
Ú     ,g,___.,,Úg?Pü~                                                 g¿,,,.
  g.,gd$Pü''~``'4${              ,, ,,._            __..,,       _.,._}$$$$%'
   'ü4$$b,        '   gÚÚ,..     :} :}"üP#g,.    ,yPü~"ü4Py.   ,gP'~"üü"~`
      '$$$b.          ~ü4$$4     }$ }$    `$$b: d$}       }$b,%%}
       :$$$%            ~$$i   _.,, iiÚÚ,, `4$%%%?W,      ;$$} $$;        ,
      .}$$$P     g¿,,,. .}$$b#Pü"}: Ã$~"ü4  `$$b.`4?g,,.,g?Pü` ;?W,.,,Úg?Pü~
     ,dPü"'  .,._}$$$$%':d$$'    $}g4:       `$$$b. `~}}~``     `4?~``'4${
    ''  ,gP'``~"üü"~`  ,$$P'     iiü'        .'Pü~'                   ,d$P'
        ''            .d$$'      $}       ,g,    --IL                d$$P'
       ''            '~ü4`       :4g,     `ü'               .,,,    {$$$
       ..          /              `ü'                       '?${_.,, `üPb,
                jizm#@                                        'ü"~``'4g, ``
                                                                      ''
                                                                       ''
                     Chaos IL - Issue #5, 04/Oct/1998                 ..
                                                                      ,,

         ~If freedom is outlawed, only outlaws will have freedom~        


                       Chaos IL Issue Five Index:
                       ~~~~~~~~~~~~~~~~~~~ ~~~~~~

 01. ISSUE#5: Intro & News                                 by morgoth
 02. BezeqNet - The central of phreaking                   by morgoth
 03. Automatic Number Identification (ANI)                 by morgoth
 04. TTYs and Relay service - newschool of free calling!   by mr. jones
 05. PBX Security & Hacking bible                          by mr. jones
 06. Resources & Credits                                   *


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 

              [  snap your ass at: http://www.bezeq.org  ]


                                 ***


01. ISSUE#5: Intro & News                           


 
          ######  ##   ##  ######  #######  ########      ####  ##
         ##      ##   ##  ##  ##  ##   ##  ##             ##   ##
        ##      #######  ######  ##   ##  ########       ##   ##
       ##      ##   ##  ##  ##  ##   ##        ##       ##   ##
      ######  ##   ##  ##  ##  #######  ########      ####  ########

                   " Spreading H/P on the 972 scene "


                            !  Issue #5  !


                     (c) Chaos-IL Foundation 1998
 

greetings!

after a long, LONG idle time we, once again, bring you a brand, new, fresh
and leet issue that will dazzle you. our last release, ISSUE#4 was released
on the 26/07/98, about 3 months ago since we last shown up. yeah, we are
a bunch of lazzy junkheads, this issue is small indeed but informative as
always - I worship whoever said "It's the quality that counts, not quentity!".
we've went through some changes during the last few months and I would like
to give out a special greet to all the people who donated us and helped us
to compile this issue (and previous ones), WERD UP.


                                                         -- morgoth




NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS! NEWS!


 * I would like to welcome an oldschool phreak, back from the good
   h/p/a days in 1993 - the adorble MR. JONES!

 * some members have been removed from the memberlist due to *MAJOR*
   inactivity or just notorious lameness. don't bother bugging us about
   it since there is nothing you can do to help yourselfs, gays.

 * our irc channel #Chaos-IL is no longer supported until further announce.

 * printed, colorful issues of Chaos-IL are now available! collect your own
   Chaos-IL papers. for further information, contact with the staff.

 * NOTE! our new web site is located at: http://www.bezeq.org
   ( www.chaos-il.org is down for good ).


 - ANNOUNCEMENTS -


We are open for applications.

                 If you have any interesting information for us, and you are
 * ARTICLES *    willing to write an article about it or just to share the
                 information with us and let us handle it, contact the staff.
 
 * MEMBERSHIP *  currently, membership will be considered by the amount of
                 articles. if we want you to our membership, WE will get
                 in touch with YOU.
 


                                      :
                                      9
                          :          n$X           :
                          ?L         $$B          :X
                           $B<:     U$$$X        :X!
                           7$$N$   <R$$$@      :W$E
                            T$$$i:  @$$$&    :u$$$$
    C H A O S                M$$$$: @$$$R  :t$$$$*              C H A O S
                    ^%$_      7"$$$:7$$$R:!@$$$*!    _$%^
       I L            ~$$$N$*%_\9$$$/R$$!$$$*:/_%$$$$*~            I L
                         *$$$$$*WX!$N~$FtW#Xd$$$$$*
                          _   ^^^%$$$%%%%$$$%^^^   _
                           ^^%%##%%#$$$%%%$%%$$$%^^
                                ~~~~^:$$:^~~~~
                                      X#
                                      ||


                                GROW MORE POT!






Contact info updates:
---------------------


DOMAIN- Our new domain is currently under heavy constructions.
 
            http://www.bezeq.org/

  * major greetings goes to HOOJ for taking care the web stuff.

 
_____________________________________________________________________________


                            [ THE MEMBERSHIP ]

 
                 [  --  Chaos IL Foundation 1997-1998  --  ]


                   *  Primary Memberlist as of 01/10/98  *


  morgoth......... ( morgoth ) ... founder/chief ..... morgoth@hempseed.com
  mota boy........ ( m0ta_boy ) .. staff ............. m0ta_boy@the-hood.com
  dr. jekyll...... ( jekyll ) .... staff ............. jekyll@acid.org
  blue grass...... ( bG ) ........ member ............ shine-@usa.net
  hooj............ ( hooj ) ...... web admin ......... hooj@<encrypted>
  mr jones........ ( mr_jones ) .. member ............ mr_jones@hotmail.com
  fourth horseman. ( _4thm ) ..... member ............ 4thm@<encrypted>
  skade........... ( skade ) ..... member ............ skade@<encrypted>
  the errormaker.. ( Emaker ) .... member ............ emaker@the-pentagon.com
  the trick....... ( trick ) ..... member ............ ttrick@yahoo.com
  easy............ ( Easy ) ...... member ............ easy@<encrypted>
  mystify......... ( mystify ) ... member ............ mystify@<encrypted>
  terminal man.... ( termi ) ..... member ............ terman@netlane.com
  dissection...... ( ^[dSN]^ ).... member ............ dsn@<encrypted>


           send applications/submissions to: morgoth@hempseed.com


                                   ---


                             [ DISTRIBUTION ]
 

** Chaos IL Issues will be regulary available once released in the following
   distribution boards and sites:

Anarchy Workshop        +972-X-XXXXXXX     X Nodes    ILHQ     *on hold*
Sardonyx                +972-3-XXXXXXX     X Nodes    MEMBER   *on hold*
Liquid Underground      +972-3-XXXXXXX     X Nodes    MEMBER
  
ftp.mag.co.il          /cHaos-il/
ftp.fc.net             /pub/phrack/underground/chaos-il/
ftp.auscert.org.au     /pub/emags/chaos_il/



            _______          ______         :_____   :___.___:
         ___\     / ____    _\___  \_______ |  __/__ |___|   |
         |    |__/_|   /____/   _   _/ ___/_|____  | |   _   |____
         |    |        _    |   |   |   |   |   |  | |   |   |   /_
         |    ____/|   |    |___|___|   |   |______| |   |________|
      = =|____|====|___|____|=======|_______|========|___|======== =


                        Chaos-IL Foundation 1998


                                   ***
 


02. BezeqNet - The central of phreaking


 XXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXX
 X C X                                                                 X C XX
 X H X                                                                 X H XX
 X A X           " BezeqNet - The central of phreaking "               X A XX
 X O X                                                                 X O XX
 X S X                 explored & done by morgoth                      X S XX
 X I X                                                                 X I XX
 X L X                                                                 X L XX
 XXXX XXXXXXXXXXXXXXXx (c) cHaos IL Foundation 1998 xXXXXXXXXXXXXXXXXXX XXXXX



Yeah. that's a pure fact, a big part of you, the "eleet" Extending/PBXing people
might think that BezeqNet is the most risky ISP for PBXing through, because
it's a Bezeq subnetwork and when PBXing you are cheating Bezeq. well, thats
a major bullshit - bezeqnet is the most SECURED ISP to PBX/Extend to, and take
that as a fact. why? it's even approved in the following disclaimer given by
bezeqnet admins, and being displayed first when you log into BezeqNet system:

_______________________________________________________________________________

Bezeq, The Israel Telecommunication Corp. Ltd. welcome you to BezeqNet.
Through BezeqNet you will be able to obtain information on a variety
of topics, from different sources, and access the internet through
different internet service providers.
The Information suppliers and internet providers on BezeqNet are solely
responsible for the services they provide.
Bezeq is not responsible for the contents of information, or the quality
of service supplied by independent companies.
BezeqNet service is provided upon the condition that Bezeq shall not
be reliable for any act or omission on the part of any information
supplier or internet provider to which access is provided on BezeqNet.
_______________________________________________________________________________


In other words, BezeqNet is not an actual ISP in mainly its just a machine that
follow links to other providers and getting a doubled money for it ("money" -
not in our case :P).

 "BezeqNet service is provided upon the condition that Bezeq shall not
  be reliable for any act or omission on the part of any information
  supplier or internet provider to which access is provided on BezeqNet."

In other words, you can phreak the ass out of each provider that bezeqnet is
following a link to, and in case the provider detecting your illegal act,
they can't even report about it to BezeqNet - because as just qouted, bezeqnet
is provided upon a condition that bezeq shall not be reliable for any act or
omission on the part of any information supplier or internet provider to which
access is provided on BezeqNet. when the ISP signed to bezeqnet that they are
going to be linked through bezeqnet's network, they signed on this condition
that actually gives us a HUGE advantage when phreaking through bezeqnet.

Here are some qualified information that bezeqnet supports the phreaks with:


 *** As you know, each ISP has a monitor computer(s) that can auto manage
     the online status (users online, activities, anti-idleing, etc).
     for security reasons, due to frauding of ISPs, account hacking and the
     like, sometimes the monitoring is being made manually by a person who
     works for the ISP and he is trying to figure/scan for any illegal
     activities being made on the network (things that auto-monitoring systems
     can't always detect). this guy is going after users that are online for
     too much time and it makes them look strange, checking thier account
     info and trying to look if there was a voice report of this account
     being hacked during the last few weeks, etc. let's say the ISP we are
     talking about is SHANI for example which is connected/linkable through
     bezeqnet. when the monitor guy looks around or even the auto-monitoring
     systems checks up for some users that are online for too much time,
     they dont even mess with the users that are connected to SHANI through
     bezeqnet! why? because they just can't check it up. the linking to
     SHANI through bezeqnet is simple and being made like that: SHANI has
     one or two multi-access accounts that are owned by bezeqnet, with at
     least 200 users simulations available on them. and for example, each
     time you are choosing to connect SHANI through bezeqnet, the head
     simulation of the account is automatically opening another simulation
     (randomaly) and you are being logged through it. the monitor guy see
     the bezeqnet account(s) on SHANI's monitoring system (once again, I am
     using SHANI here for an example only) and the highest information he
     can about this account is the number of users that are connected through
     it. therefor, there is NO actual information about you on the ISP even
     if you are connected for a few days in a raw!


Techniques for the BezeqNet phreak
----------------------------------

* Stay ON *

If you are a daily bezeqnet phreak, you prolly know those pissing situations
when you come back after idleing and notice you've got disconnected. well, this
annoy shit can be easily arranged. if you are using Win9X OS get a program like
StayOn or AutoCon that will use the connection way you configure it and will
auto-reconnect to the net when getting disconnected.

one or more of these programs can be reached at:


                 BLACKACID.PHEARED.COM  &  WWW.TUCOWS.CO.IL


If you are using a *X OS, i know such script program for Linux that can be
reached at WWW.LINUXNOW.ORG - about other OSs, just check it out from your OS
homepage link to archives or the like.


* Taste some hax0ring *

BezeqNet are well backdoored, here a pretty nice one that i've found out during
connection attemp-  total normally, I connected to bezeqnet and instead of
getting the features providers screen I got this prompt:


<bezeq-2005/23-4-069>

I didn't actually knew WTF is going on, but as in all systems, I tried getting
some info with the help comand and this is what I got:


<bezeq-2005/23-4-069>?

 help     Help screen
 mode     Turn off privileged mode
 ppp      start PPP connect
 telnet   Open a telnet connect
 tunnel   Open a tunnel connect
 exit     Exit from procedure

<bezeq-2005/23-4-069>


Have you ever attempted to connect and got this? if so, this is your LUCK DAY.
I couldn't actually figure what does this system is used for, but because
all I did was calling bezeqnet, I assume they were rebooting/rehashing right
when I was attempting to connect and because of that, I got into this section.
however, the TELNET command will be used just as in normal VT100 telnet, but
without any graphics ofcourse. the TUNNEL command didnt worked for me, so I
have no idea how is it working. the PPP command is the magic of this thing :),
it will connect you to the net in PPP mode, directly through the main BezeqNet
computer. the other day I found out about this thing, I used the PPP command
to connect and I was online for over 5 days in a raw... as I said, if you
attempted to connect and got into this section, this is your lucky day :)
your domain will be bezeq.net or bezeq.co.il. the EXIT command will disconnect
you, so don't use it unless you can't find any use from this system. I couldn't
figure the MODE command, it prompts to turn off the privileged mode, which
means that the current mode we are in is privileged? I couldnt find any hided
commands that might be for privileged mode only. if you find any, let me know.


This is it. hopefuly I'll add more new information in future.

for further information / questions / etc ... email me at morgoth@hempseed.com


03. Automatic Number Identification (ANI)


    :                                                                    :
   ||                                                                    ||
 ==||====================================================================||==
   ||                                                                    ||
   ||               Automatic Number Identification (ANI)                ||
   ||                                                                    ||
   ||                            by morgoth                              ||
   ||                                                                    ||
 ==||====================================================================||==
   ||                                                                    ||
   :                                                                      :
                      (c) Chaos IL Foundation - 1998!

( --------------------------------------------------------------------------- )


ANI stands for Automatic Number Identification. it's a packet that is sent
everytime you dial at least 7 digits on the phone <or more if its an 177, 1800
number> that tells alot of information about you. it gives the name of the
person the phone number is registered to, the phone number and area code, and
any other information relating to you directly. this technology was here since
bezeq first started, but the devlopment for it has first started in 1990,
when bezeq found out about too many frauds going around thier network.


alot of people were asking me "Do 177, 1800, etc numbers get my identification
and information when I call them?"  well, the answer unfortuneatly is yes.
but, thanks to the phreak-full minds around us, anything as always, can be
bypassed. as said above, ANI is a machine that sends a packet to your line,
getting an identification reply from your line and logging it. the action is
similar to ctcp ping / ctcp ping replys when ircing. as you probably know,
bezeq's and other telecommunication networks most fimilar problem is the
situation called "voltage overflow" that happens (in our case as in Bezeq),
when the network tech is taking too much then what it can provide. that usually
happens when too much calls are made at once, etc.  for using as less as
possible network resources and to prevent from a voltage overflow in future,
the ANI machine is built to identify only 1 route of signalling. in other
words, it can get identification info on only 1 phone line.


this will make it more clear for you; let's say I have this IBM free 177 #
which lets me connect the net with no charge at all. I want to connect it,
but I am afraid that IBM will get my line information through the ANI and
will trace my ass. so, I am connecting from a PBX, or any other exchange
that can let me do another route (call).




                                      ANI                    ANI
          ** ------------------------ ** ------------------- **
          ||                          ||                     ||
          ||                          ||                     ||
          ||                          ||                     \/
          ||                          \/              IBM Free 177 (example)
          \/                          PBX
       morgoth's
       stinky                     ( route 2 )
       house

    ( route 1 )


I called from my line, to a PBX, and from the PBX to IBM. all this way from my
line to IBM is 2 routes. and as I said before, ANI detects the last route only.
which means, that as IBM knows, the call that was just made into thier 177 was
made from the PBX. and thier ANI logs the last route, which is route 2 (PBX).

Conclusion: Connecting a number through a PBX/Extender or any exchange that
lets you open another route (call) is secured in  * 100% *  and totaly gets
you out of any traceable possibility!


thats it. if you _really_ need some further information about ANI, I can help
you. or if you have some headache questions regarding this article:

    morgoth: morgoth@hempseed.com

thanks to: Foneman, prym, Eagle_1, player-x



04. Israeli TTYs/TTDs and Relay service

  ----------------------------------------------------------------------------
  -                                                                          -
  -                 - Israeli TTYs/TTDs and Relay service -                  -
  -                                                                          -
  -                    the newschool of call frauding!                       -
  -                                                                          -
  -                   done by Mr. Jones / cHAOS.IL 1998                      -
  -                                                                          -
  ----------------------------------------------------------------------------


TTYs/TTDs and Relay service - by Mr. Jones
------------------------------------------

introduction:
-------------

You can make free calls anywhere in the world with the help of
TTY/TTD relay service,  let me explain what TTY/TTD is, its a
machine/device, it has acoustic couplers, a keyboard and a lcd
screen.  If you dont have a tty, you can still make your computer
into a tty, just get a terminal program that can set your modem
at 110 or 300 baud, half duplex, 8N1 parity, and CR settings, i
will explain more howto setup your computer to act like a tty later
in this article.
TTD/TTY Relay Service is a service for Deaf people with TTD/TTY's
they call the relay service and make calls to hearing people... and
the operator relays it all.

its like this --

operator==> Tel-Aviv Relay Service Relais operator #8032 ga

me==> Hi id like to make a call to John Doe at Tel-aviv, 03-677XXXX ga

operator==> Okay,  Dialing.. ringing 1, 2, hello ga

me==> hello, this is mr jones.. how are you doing John ga

john==> im doing fine, how about you? ga

me==> i gotta go,  bye sksk

operator==> would you like to make another call? ga

me==> no thanks, bye for now ga to sk

operator==> have a nice day sksk

me==> (thinks, yeah.. thanx for the free call) sksk

*click*

thats a example of a relay operator conversation with a friend.

how the relay service works:
----------------------------

the Operator has a tty and a telephone, you call the relay operator
and type what you want to say to the hearing person, the operator
reads what you type and speaks it to your friend, and your friend
speaks back, and the operator types what your friend says to you.
and you type back.

making free callz using relay service + extender or pbx:
--------------------------------------------------------

Ok,  I found out a really neat thing.. i called to Hertzellia's relay service
with a extender,  (pbx/extendernumber,,code,,relayservice#).
then the bell relay operator answers,  i asked her what my # was,
the relay operator said it was 177022XXXX (thats, the # of the extender i
used to call the relay service in Hertzellia) bingo.  The relay operator
doesnt know my real # and therefore i can make long distance calls anywhere in
the whole world.  And the operator charges those calls to the extender,
not your number!

setting up your computer to call tty relay service:
---------------------------------------------------

Now, you dont have a tty eh? go buy one! but ehh, its way too much money if you
are not a deaf person. you can turn your computer so that it acts like a tty!

ascii code is used,

ASCII stands for American Standard Code for Information Interchange,
Some TTYs and all computers in the US/Canada use ASCII code.  IF you
use ASCII, you may need to change some options.  The options you can
change are as follows:

Baud rate, is how fast characters travel.  You can choose 110 or 300
baud, but 110 is relay used.  The default baud rate is 300.

Duplex, controls how characters are displayed.  If you get double
characters, (lliikkee tthhiiss)  or none at all, change the option
between half duplex and full duplex.  The default is half duplex.

Parity, controls error-checking,  You can choose 7N1, 8N1, 7E1, or
7O1.  The first number is data bits.  The middle letter means
(N)o parity, (E)ven parity, or (O)dd parity.  The last number is
stop bits.  8N1 and 7E1 are used most often. The default is 8N1
parity.

Return,  Determines what the TTY sends when you press the return key.
You can choose CR or CR/LF.  Cr (carriage return) goes to the beginning
of the current line.  CR/LF (carriage return plus line feed) goes to
the beginning of the next line.  The default is CR.

To connect your computer to a TTY, you shuold use 300 baud, half
duplex, 8N1 parity and CR settings.

TTY Language (Conversation Etiquette):
--------------------------------------

you need to know tty codes to communicate with the Operator, when you connect
a TTY. the language is usually Hebrew, but they will talk to you on English
too. anyway i dont even know the way they talk hebrew, because i live in israel
for only 2 years..

GA =When you talk with another person by TTY, you type while the other
person reads.  When you want the other person to respond, type GA
for "Go ahead."
ie.  hello john, how are you GA

GA OR SK =To say goodbye, type GA OR SK.  This gives the other person
a chance to say any last words before ending the conversation.

SKSK =Type SKSK to end the conversation.

Q =Some people prefer to type Q instead of a quetion mark because
it saves time and is easier to type

You can use punctuation marks such as commas and periods, although many people
choose to omit them.  you may also abbreviate words, such as:

GA = go aheadOPR = operator
SK = stop keyingPLS = please
CD = couldQ = question mark
CUL = see you laterR = are
CUZ = becauseSHD = should
HD = holdTHX = thanks
MTG = meetingTMW = tomorrow
NBR = numberU = you
OIC = oh i seeUR = your

getting TTY relay service #s:
-----------------------------

call 144, ask for some #s of "deaf centrals", places like schools for deaf
people, union for deafs, etc. call those places and say your brother is deaf
is deaf, you bought him a TTY and you want #s of relay services in your
areacode. you better not say "TTY", say a number when he can use the telephone
deaf machine to make calls, etc.. all depends in your level of bullshitting!
personally, i have pretty much #s but i don have them all yet.. i think there
are more then 5 TTYs in each areacode for sure..


extra technincal info:
----------------------

Communication Codes;

Automatic code detection on outgoing calls (Turbo Code, ASCII or Baudot)

Baudot Code:
45.5 and 50 baud
Senstivity: -45 dbm, 67 dBSPL (min)
Output: -10 dbm

Turbo code:
100 baud (average)
7 data bits

ASCII Code:
7N1, 8N1, 7E1, and 7O1
110 and 300 caud
Answer and orignate
Full and half duplex
Compatible with Bell 103 modems

---

So, just set your modem up and dial a extender then the relay
service, boom.. call any friend anywhere, anytime. :)

article by mr_jones.
any questions, reach me at mrjones@hotmail.com or irc/efnet - mr_jones

c'ya all

[EOA]



05. PBX Securityh & Hacking bible


  #  01/10/98                                                           #
###########################################################################
  #                                                                     #
  #                   ((-  PBX Hacking bible  -))                       #
  #                                                                     #
  #                     ((-  by MR. JONES  -))                          #
  #                                                                     #
#################### (c) Chaos IL Foundation 1998  ########################
  #                                                                     #


Note from the author:

well, I have'nt been around for a few years since I was abroad. I hope some
old people who are still alive (from the old scene) can still remember me ;)
I say HI to The Highlander.. if you are still alive and see this! ...

I was one of the first people to use pbx's in israel and I have'nt noticed
any stuff changing util today. hope it'll stay that way forever ;)

___________________________________________________________________________


I am not writing this to get a whole bunch of .il newbies in trouble.
that is not my intention. I want the public to be informed on how to hack
pbx's nowdays. actually not that much has changed. but if you have a
few minutes, I can share with you my ideas on how to hack them, and what
ive learned about not getting caught. the main thing you want to keep in
mind is, you want a toll free PBX, so you can call it from payphones and
talk away, free of charge. the best way ive found to get them is to use
Toneloc (or your favorite scanner) to scan for tones. pick a prefix you
think will be decent. when I pick i prefix I usually try even numbers,
like 177-022, 177-100 .. but it doesnt really matter. what toneloc is
doing when you scan for tones is, it puts the regular dial string with a
W; after it.  ( ATDT177-022-0000 W; )

 *  get used to putting ATS11=40 in your init string.. it speeds dialing  *

once you have a logfile of the scanner with a few pbx #'s in it...
its time for the hack. dont be stupid! do not call ANY of those pbx's in
the logfile from home (again). you already called it once (with your
computer) that was enuf, your ANI has already been logged by the company
you called, but its no big deal you havent done anything wrong damnit!@#
(take a look at the article covering "ANI" by morgoth if you donno whats ANI)
print out the logfile with the founded numbers. clear your phone line and
make sure you have a pen. call the 1st one on the list. you really want to
do this as fast as possible unless you are a bumfuck and you wanna have all
day to waste on this shit.

when you hear the familiar tone the 1st thing going thru your mind
should be, "I want to find out how many digits this code is".  most of the
time this can be figured out by hitting 9 and counting how many times
you can hit it before you get another tone or a message comes on saying
invalid code. the best numbers to try 1st are:


 *  hit 9 and wait a few seconds, see if you get another tone.

 *  try hitting 9# if that doesnt work try 8# and so on. its worth a shot


what you are really trying to get is a dialtone or a different tone then
the one that answered. when you hear the different tone, you can pretty
much guess you have an unrestricted dialtone.
if these first few methods didnt work (no worries, they probably wont,
most companies are getting smarter in the 90's)  Then you want to move
on to the brute force method. once you have established how many digits
the pin you are looking for is (we are going to say this PBX is a 4 digit
pin, because after it answers if you hit 4444 an operator comes on and
says you have entered an invalid code) you get your pen and paper ready
and write down something similiar to this:

0000   2222   4321   5000  7000
1000   2345   4000   5111  7111
1111   3000   4444   5678  7777  ( see a pattern developing?! )
1234   3333   4567   6666  8888

keep on calling back and trying the next code on the list. those are
just a few common ones for a 4 digit pin. I didnt list them all i think
you can figure it out. try 9999 of course, it is usually a popular one ;)
If none of the codes work that you would think are the most moronic you
have to spend some time calling and entering #'s in sequentially.
Eventually you will get it. if you are attempting this method use it on a
3 digit code pbx. 4 digit could take you forever w/o a computer.  If you
find that a PBX has an 8 digit code or more. you have 2 options:

1. SAY fuck that PBX there is millions out there waiting for me
2. HACK it from home with your computer and get caught!@#

so what im basically saying is stick with the 3 and 4 digit code PBX's
they are MUCH easier to gain access to. move on down the list until you
have circled the ones you want to try and hack. dont spend too much time
on one pbx unless you only have a few there. if for some reason an
operator comes on, hang up dont mess with her. call the PBX back at a
later date and retry. also some PBXs you will call and get a voice
operator. Look at the time your computer found it, call back at that time,
alot of PBX's have hours and will only work after the company is closed.

once you have access to the PBX dont give it out to everyone. That is the
quickest way to see one dies. keep it to yourself, and stick to the following
rules I've collected:

##  you might use it from home, with your regular line. but this risk can
    cost ya in bigtime, in case you dont know who owns the PBX - you dont
    know who are you messing up with. make yourself a limit and never use
    the PBX from your home with your own line unless it is an "emergency".

##  if you are about to use it for LD calls, you better figure what company
    owns the PBX and what kind of a company are they. nearly, international
    company wont detect your LD calls considering they are pretty short and
    rarely. but, a local (Israeli) company will get the PBX or YOU down
    after your LD calls will be shown up in the first month billing!

##  it's always recommanded to check who you are messing with and find out
    as much as information possible about the PBX owners. if you have any
    other (secured) free calling methods, take no risks at all and always
    connect the PBX thought your other free calling method (extender, etc)
    nobody requirs that.. ;)


                               ### END ###


                         [  done my Mr. Jones  ]

            [  greetz:  serial-k, morgoth, suspekt, skade  ]

                             all of CHAOS IL

                 send questions to mr_jones@hotmail.com


______________________________________________________________________________



06. Resources & Credits


Bezeq TeleCommunictions INC.
Barak Israel-International INC.
GreenShop Computers (TEL-AVIV)
IDC Communications INC.
AT&T Communications INC.
SPRINT Global-One Communications
Israel Telegraph LTD.

2600 Magazine
Phrack INC. Newsletter
Informatik E-Magazine
PLA-Phone Losers of America
Hacker's Heaven (BBS)
Underground Society (BBS)
Route 666 (BBS)
Liquid Underground (BBS)

#972
#phreak
#telephony
#root
#2600

www.border.com
www.etext.org
www.l0pht.com
www.lat.com
www.itd.nrl.navy.mil
ftp.fc.net

The Prototype
Captain Crunch
"T.S" (Bezeq 144/199 Operator)
"C.B" (Bezeq 188 Operator)
"N.I" (Sprint Global One Operator)
retro
Manomaker
phriend-
Anti-D
deadzed
prophet
Substance
jizm
stoner
f0k
Mindroot
skade
Toast
BelowZero
*ALL of Chaos-IL Members

-[EOI#5]----------------------------------------------------------------------

(c) Chaos-IL Foundation
       October 1998
