A Guide To A New Generation of Phreaking

All you've ever wanted to know about Phreaking. Many of the actions described in these tuts are illegal. They are presented for informational purposes only.
Post Reply
User avatar
Net Battle Bot
Owns you
Posts: 1816
Joined: Fri Jun 04, 2004 6:44 am
Location: Groom Lake

A Guide To A New Generation of Phreaking

Post by Net Battle Bot » Tue Feb 22, 2005 7:14 pm

Code: Select all

Authors Note: Amended in 2004 for my sanity!
A Guide To A New Generation of Phreaking* 

-Network feature codes 
-Carrier Test Numbers 
-ANI numbers 
-Carrier overide codes 
-Other Interesting Numbers
Trunked Radio System Information
-Menu Codes 
-How To send Free SMS and SMSc 
-IMEI tracking 

Common Test numbers 
These are some common numbers that all carriers should respond to, 
I have tried the last two and they work fine. but when i dialed the first number i got an engaged signal.
018 01 8222  Own number RVA 
12711  Long distance carrier pre-selection confirmation 
1800 80 1921  Own number RVA 

These are some common numbers that all carriers should respond to, 
I have tried the last two and they work fine. but when i dialed the first number i got an engaged signal.

ANI-(A)utomatic (N)umber (I)dentification. 

basically when you dial an ANI number the 
number of the phone you are using is read back to you. 
this is how payphone numbers were gathered in the olden days.
(how pathetically ignorant of me - deci 04 ;) 

ANI inc. mobiles: 018 018 222 
Telstra ANI:    127 22 123 
Telstra ANI:    1800 801 920 
Optus ANI:      127 23 12 
iPrimus DCX:   1800 855 747 

CND blocking prefix 
Used to block outgoing CND info for a single call on a line that is preset to automatically send CND information. so basically its good for hiding your phone number from mobiles and other new Calling Number Display LCD phones and service numbers such as *10#. 

CND blocking prefix: 1831(+ phone number) 

CND sending prefix 
Used to send outgoing CND info for a single call on a line that is preset not to automatically send CND information.layman term to make it so people can see your number. Some people may remember using the 1832
prefix to obtain CT4 (Goldphone) numbers.

CND sending prefix:  1832(+phone number) 

For Optus CND blocking prefix 
see the Optus Network Codes further down the page. 

Carrier Pre-selection Over-ride Codes 

Use a prefix code before the STD/IDD (phone)number you want to call to select a carrier (other than your pre-selected carrier) for that call. 

PREFIX | Allocated To 
1410 Alterna Telecom Pty Limited 
1411 Telstra Corporation Ltd 
1412 iiTel Pty Ltd 
1414 AAPT Ltd 
1415 Vodafone Network Pty Ltd 
1419 AAPT Ltd 
1422 Worldlink Telecommunications Pty Ltd 
1423 Edge Internet Services Australia Pty Ltd 
1424 AAPT Ltd 
1425 Hutchison Telecommunications (Australia) Pty Ltd 
1428 MCI WorldCom Australia Pty Ltd 
1433 The Internet Group Limited 
1434 Pacific Gateway Exchange (Australia) Pty Ltd 
1440 The Ozitel Network Pty Ltd 
1441 RSL COM Australia Pty Ltd 
1450 Prodigy Communications Australia Pty Ltd 
1455 Primus Telecommunications Pty Ltd 
1456 Cable & Wireless Optus Ltd 
1464 Davnet Limited 
1465 AAPT Ltd 
1466 Primus Telecommunications Pty Ltd 
1468 New Tel Networks Pty Ltd 
1469 AAPT Wireless Pty Ltd 
1470 KDD Australia Pty Ltd 
1474 Powertel Ltd (Spectrum) 
1477 Global One Communications Pty Ltd 
1478 One.Tel Pty Ltd (no longer operating) 
1479 One.Tel Pty Ltd (no longer operating) 
1483 Finkelp Pty Ltd 
1486 Flow Communications Pty Ltd 
1488 Digiplus Pty Ltd 
1499 WorldxChange Pty Ltd 

Telstra Test Numbers 
All test numbers for Telstra begin with 12722. 
so phreakers get to your nearest payphone and start scanning.  
here is the list so far. 

12722 0  CND send status  

12722 123  Own number RVA (old number 19 123) 

12722 199  Ringback (old number 199)  

12722 40001  "The number you have called is not available from this service" 

12722 40003  "This service is not connected" 

12722 40004  "Your attempt to use this feature has been unsuccessful" 

12722 40005  "The feature you have tried to to use is not provided" 

12722 40006  "The number you have called is not connected" 

12722 40007  Recorded busy tone 

12722 40008  "Congratulations. You have accessed a standard network test message recording" 

12722 40009  "The person you are dialling now has a new telephone number.  To find out the new number please call Telstra's changed number information service" 

12722 40010  "The number you are calling is currently unavailable" 

12722 40020    "The number you have called is not compatible with your equipment" 

12722 40023  "The service type you have requested is not provided" 

12722 40024  "You have attempted to call via a service provider network. 
All lines are currently busy.  Please delay your call for a short time" 

12722 40033   "This number is not in service. Please use the alternate  number for the person you are trying to contact" 

12722 40034   "This telephone number cannot be dialled with an area code. Please try again without using the area code" 

12722 40035   "Thank you for using Telstra for your long distance calls" 

12722 40036   Congestion tone 

12722 40037   Congestion tone 

12722 40064   "Operator assisted calls are not permitted to this number" 

12722 42209   "Your Telstra call waiting feature is on" 

12722 42210   "Your Telstra call waiting feature is off" 

12722 42211   tone... "Your Telstra call waiting feature is on" 

12722 42212   tone... "Your Telstra call waiting feature is off" 

ah the old call back.. 
12722 199 
*note that number will only ring..so not like the old 199 number where you would hang up and then the phone would ring. 

Optus Test Numbers 
Test numbers for Optus all begin with 12723, so phreakers once again start scanning. 

12723 12  Own Number RVA (old number 127 2311) 
12723 22  1kHz 
12723 99  Ringback 

Optus Network Codes 

FAT = Feature Access Tone 
RVA = Recorded Voice Announcement 

CND Blocking Prefix  *31 (FAT) phone number  
CND Sending Prefix  *32 (FAT) phone number  
Selective Call Reject *60 
Selective Call Divert  *63 
Selective Call Accept  *68 
Call Return  *69 
Call Divert  *78 (FAT) phone number 
#78 (FAT) 

Call Waiting  #87 

VoiceMail Access  *96 
Speed Dial  *99 abbrev code number # 

Telstra Network Feature Codes 

FAT = Feature Access Tone 
RVA = Recorded Voice Announcement 
AXE = Ericsson Exchange 

Last Number Redial (AXE Only)  0# 
Call Return                              *10# 
Multiple Number - 
Second Line Number   *11*2# 

(2nd dial tone)             *21+phone number# 

Call Waiting over-ride per call (AXE Only) - *44+phone number 

Call Waiting -      *43# (FAT) 

Auto Call Back -   Recall *37# (RVA) 

Delayed Hotline -  *53+hot line number+#  

Smart (Selective) Ring -    *88# (RVA) 

Call Forwarding on No Answer -   *62# 

CND blocking per call -           *31#+phone number 

The last one would have to be a favourite or at least very useful 
in particular situations. The CND blocking per call Number (*31#+phone number) is used for blocking calls from a particualr 
number...say the number of your fanatically obessed ex-girlfriend 
or maybe the number of a cuban cocaine dealer that you happen to owe money too. 
For people who dont understand how to use it, 
what you do is: 
-Pick Up The Phones reciever or handset. 
-Dial *31# then enter the phone number of the person who you dont want calling and yay....no more hassels. 
(unless they ring from a different number or a payphone , then your 
-Hang up the phone =P
Please note you have to pay extra for this service. 

Interesting Numbers  

FAST is a testing number for telstra field technicians. 
its number is 1800 050 051. 
to use FAST you will need a telstra employees PIN and ID number. 
there were a few ways of bypassing the employee and pin bit using *** 
(three asterixes, the asterixes still acts as wildcards in the phone world too.) To a phreak in australasia gaining access to FAST is better than gold.

BISCOM - This is a commercial MPT1327 network operating in the State of Victoria. 
It is owned by a company called Radio Technolgies.
It uses frequencies between 165.2 and 168.0625 MHz. 
Tasmania is setting up a state wide EDACS protocol trunked radio network, 
operating with base output frequencies 865.000 to 870.000 MHz, 12.5 KHz steps,
and up to 5 channels per base station, each 1 MHz apart as per Australian convention
(ie 865.4875, 866.4875, 867.4875 etc). With 50 planned base stations for this island state,
the objective is to provide 90% indoor handheld coverage for the whole island! Planned users are:
Hydro Electric commission, Tasmania Police, with other users able to join, but no mention of anyone
else taking the system up as yet. AEGIS will be implimented for the Police 

Telstra Fleetscom -  MPT1327 - This is a Australian nationwide
commercial trunked network which operates on
frequencies between 415.575 and 418.075 MHz. 

Victorian Public Transport Corporation - An MPT1327 network used by the Trams and Trains
in the State of Victoria. It is uses
frequencies between 415 and 417 MHz. 

Victoria State Government - MPT1327 - Frequencies between 163.825 MHz and 165.1875 MHz.
Used by State Electricity Commission,
Department Conservation & Natural Resources,
Environment Protection Authority,
Courier Companies,
Ambulance Transport Companies,
Victorian Road Transport Authority (Vicroads Grand Prix Corporation For 1997 Aust. F1 Grand Prix) ,
and Telstra Breakthrough Communications. 
Operated on a commercial basis by Telstra Corporation. 

Victoria Communications - MPT1327 - This is commercial network in the State of Victoria.
It uses frequencies between 415.575 and 418.075 MHz.

How to send free SMS and SMSc 

The following is a list of most the SMSC's (Short Message Service Centers) around the world. These can be used to send text messages for free. 

All you need to do is change the service center number on your phone (under "message settings") to one of the networks below. Don't choose your own network as you will get charged for it. 

There are just a few things to remember when trying this: 

If you use a network outside of your country, you will need international call roaming enabled (speak to your service provider about this). 

The network you are using may not be able to send to the network you are trying to send to. Therefore it may accept the message but can't send it. 

If you use a network outside your own country you will need type the recipients phone number in international format for your country because it's being sent abroad. 

For example we are in the UK and to send someone we know a message for free using a forein service center we would type in the ANDORRA message center into our phone and send it to +447788123456. 

The networks are becoming wise to this and are barring you from using their SMSC if your not on their network. Therefore it could become time consuming to find one that works. 

Remember though, when you find one that works, keep it to yourself because the less people know about it, the better. 

Number List 

One.Tel Australia +61 411 990 001 
Vodafone Australia +61-415011501 
Telstra Australia +61-418706700 
Telstra Australia +61-418706800 
Telstra Australia +61-418706900 
Optus Australia +61-412025989 
Optus Australia +61-411990000 
Optus Australia +61-411990001 
Optus Australia +61-411990003 

A1 +43 664 0501 
Connect ONE +43 699 0001999 
max-mobil +43 676 021 
tele.ring +43 650 09000000. 

Azercell +994-50-910-3300 
Bakcell +994557070707 

Batelco +97392 
Batelco +97394 
Batelco +97396 
Batelco +97398 

GrameenPhone +88017099999 
GrameenPhone +88017500569 
AKTEL ??? 

Mobistar Belgium +32-95955205 
Mobistar Belgium +32495002530 
Proximus Belgium +32 475 161616 
Orange Belgium +32-486000005 

Bosnia and Herzegovina 
PTT GSM BIH +387-66-125522 

Mascom Wireless +267-71010024 
Vista Cellular +267 72000003. 

Brunei Darussalam 

MobilTel: +35988000301 

Fido Canada +1-5149931123 

Entel PCS +56-98890005 

Telecom China +86-1390591500 
Telecom China +86 13800100500 

Cronet +385-980501 
VIPNET +385-910401 

Cyprus +3579700000 

Czech Republic 
Eurotel Czech rep +420-602909909 
Radiomobil Czech rep +420-603051 

Sonofon Denmark +45-40590000 
TeleDanmark Denmark +45-40390999 
Telia DK Denmark +45-28187000 
Mobilix Denmark +45-26265151 

Free! +45 40590006 

Click GSM +20105996500 
Mobinil +20122000020 

EMT Estonia +372-5099000 
Ritabell Estonia +372-5509911 
Radiolinja Estonia +372-568771010 


Radiolinja Finland +358-508771010 
Sonera Finland +358-405202000 

SFR France +33-609001390 
Bouygues France +33-660003000 
Itineris France +33-689004000 
Itineris France +33-689004431 
Itineris France +33-68900458 

D1 Germany +49-1710760000 
D1 Germany +49-1715990000 
D1 Talkline Germany +49-1710760900 
D2 Germany +49-172227033 
D2 Germany +49-1722270000 [to D2 only] 
D2 Germany +49-1722270333 
D2 Talkline Germany +49-1722270258 
Debitel Germany +49-1722270222 
IC3S Germany +49-1722270201 
Dr Materna Germany +49-1722270111 
E2 VIAG Germany +49-1760000443 
E-Plus Germany +49-1770600000 
E-Plus Germany +49-1770610000 
E-Plus Germany +49-1770620000 


Panafon Greece +30-94219000 
Telestet Greece +30-93599000 
Telestet Greece +30-93597000 
Cosmote Greece +30-97100000 

Libertel Netherlands +31-6540881000 
PTT Netherlands +31-653131313 
Telfort Netherlands +31-626000230 
BEN Netherlands: +31-624000000 
Dutchtone, Netherlands: +31628500561 

Hong Kong 
Hutchinson Hong Kong +852-94985795 
HK Telecom Hong Kong +852-90288000 
Smartone Hong Kong +852-90100000 
Hong Kong +85292040032 

Pannon Hungary +36-209300099 
Westel900 +36-30-9888-000 
Vodafone +36709996500 

Landssimi Islands hf +354-8900100 
Tal +354-6999099 

Eircell Ireland +35387699989 
Esat Ireland +353-868002000 

India [+91 - ] 
AT&T Network of India 
BPL Mobile India +91-9821000005 
MAXtouch India +91-9820005446 
Essar Cellphone +91-9811009998 
Tata +919848001104 
Command +919830099990 
AirTel Delhi +91-98100-51914 
Skycell Cellular +919840011003 
Spice Karnataka +919844198441 
Spicell +919831029222 
Usha Martin Telekom ltd +919830099990 

Satelindo Indonesia +62-81615 
Satelindo : +62 816 124 
Satelindo : +62 816 125 
Satelindo : +62 816 126 
Satelindo : +62 816 127 
Satelindo : +62 816 128 
Telkomsel Indonesia is +62-81100000 
Exelcomindo Indonesia +62-818445009 

Isle of Man 
Pronto GSM +447624499955 

Orange Israel +972-54-120032 

Omni Italy +39-3492000200 
Omni Italy +39-3492000300 
Omni Italy +39-3492000400 
Omni Italy +39-3492000500 
TIM Italy +39-3359609600 
TIM Italy +39-3359608000 
TIM Italy +39-338960960 
TIM Italy +39-338980000 
Wind Italy +39-3205858500 

Safaricom +25472500010 
Kencell +254733000810 

MTC +96596000303 
Al-Wataniya +9656373717 

LMT Latvia +371-9202020 
Baltcom GSM +371 9599994 

FTML Cellis +61-3488888 

Vodacom Lesotho [+266] 

Bite GSM Lithuania +370-9950115 
Omnitel Lithuania +370-9899992 

PTT Luxembourg +352-021100003 
Tango Luxembourg +352-091000030 

Comviq Sweden +46-707990001 
Comviq Sweden +46-707990002 
Comviq Sweden +46-707990003 
Comviq Sweden +46-707773078 
Europolitan Sweden +46-708000708 
Telia Sweden +46-705008999 

Switzerland [+41-79] 
Swisscom Switzerland +41-794999000 
diAX Switzerland +41-765980000 
Orange +41-787777070 

Tritel +255812904000 

Chung Wa Tele Taiwan +886-932400821 

AIS Thailand +66-18110888 
WP1800 Thailand +66-16110400 

Turkcell Turkey +90-5329010000 
Turkcell Turkey +90-5329020000 
Turkcell Turkey +905329030000 
Turkcell Turkey +90-5329040000 
Telsim Turkey +90-5429800033 

UMC +38050000501 
Kyivstar +380672021111 
Golden Telecom +380444990000 
Wellcome +38044 251 7777 

United Arab Emirates 
PTT UAE +97150 6014994 

United Kingdom 
Isle of Man Pronto GSM +447624499955 
Vodafone UK +44-7785016005 
CellNet UK +44-7802000332 
Virgin Mobile UK +447958879890 
Orange UK +44-7973100973 
Orange UK +44-7973100974 internal 
One2One UK +44-7958879879 
Guernsey Telecoms [+44-4481/7781] 
Jersey +44-7781 

Aerial Comms USA +1-8132630025 
Aerial Comms USA +1-2812350025 
Voicestream USA +1-2063130004 
Pacific Bell USA +1-2099042010 
Pacific Bell USA +1-2099042020 
Pacific Bell +1-2099042030. 
Powertel USA +1-3343338200 
DigiPH PCS USA +1-3342090307 
Omnipoint USA +1-9179070004 
Sprint USA +1-7044100000 
Washington PCS USA +1-410258953

This piece of info is handy if you dont want your mobile to be stolen
and if you would like to track it down in case it ever gets stolen.
Type *#06# on your mobile and it will display a 15 digit International
mobile equpiment identifier (IMEI) number. write this IMEI number down.
When ever a new SIM card is inserted into the mobile the IMEI gets 
stored on to the SIM. Hence its possible to track down the mobile number
given the IMEI. 

Thanks @ Hackinthebox (www.hackinthebox.org / dalnet #hackinthebox) 


LP# (08) 97554548 @ Amblin Caravan Park (Ask for b0champ :))

EDITORS NOTE (7:08 PM 1/09/04)

When I look back at this file (with an evolved perception)
all I can see is 'try-hardness' or rather '1337ness' aspects
of a young teen. Thank satan for maturity.




#LP = local payphone number

151 Victoria St Bunbury

O/s Exch On Verge (Country)

(08) 97219200

Without practice one cannot prove; without proof one cannot be trusted; without trust one cannot be respected.

Post Reply