Re: [PEN-TEST] War Dialling

["Leibolt, Gregory, NBSO" <gleibolt () ATT COM>]

I've found that it is always best to go directly to the PBX switch
administrators to get the range of numbers that are valid.  You can then use
ranges of a data file of valid numbers in tools like ToneLoc or THCscan.

Greg

-----Original Message-----
From: Scott, Mick [mailto:Mick_scott () UK IBM COM]
Sent: Thursday, November 16, 2000 7:00 AM
To: PEN-TEST () SECURITYFOCUS COM
Subject: [PEN-TEST] War Dialling


Being a new member to this list I am not sure how much this topic has been
aired.  How ever I wonder if anyone has any ideas, or pointers on how they
would eliminate irrelevant numbers on a war dialling exercise.

If acme.com, a global company, has a very wide range of numbers how is it
best to seek out the numbers that are relevant to the IT departments.
Obviously there is the social engineering approach, however I am interested
in any other ideas.

Apologies if this has been discussed B4


Regards,
Mick