Phonerator, an advanced *valid* phone number generator for your OSINT/SE needs

Couple years ago at DEF CON‘s Recon Village, I introduced a new OSINT technique to obtain a target’s phone number by just knowing the email address and published the tool "email2phonenumber" which automates the entire process. email2phonenumber, among other things, generates possible phone numbers for the target based on the Phone Numbering Plan of the target's country.

This year, I am introducing "Phonerator", a web-based tool to search, filter and generate *valid* phone number lists. Taking the phone number generation process of email2phonenumber to the next level, Phonerator allows you to provide only a few known digits of your target's phone number and start creating lists of possible (and valid) numbers. You don't have any intel on your target's phone number but know which carrier he uses, area he lives in, date when he started using the number? Phonerator can take in all those pieces of information and help you narrow down possible phone numbers.

Phonerator is also a great tool for discovery and research. Want to find obscure and unknown carriers together with the phone numbers assigned to them for your wardialing needs? Phonerator can help. Want to abuse "Contact Discovery" to find in which websites your target is registered? Phonerator can export your curated list of numbers in vCard format to easily import to your test devices. Join this talk if you are an OSINT lover, SE professional, phreaker or just curious about how phone numbers get assigned and how you can profit from it.

1.  Phonerator
An advanced *valid* phone number
generator for your OSINT/SE needs
Martin Vigo
@martin_vigo | martinvigo.com

2. Red teamer | Podcaster | Founder de Triskel Security
Galicia, Spain
Research | Bug bounties | Gin tonics
@martin_vigo - martinvigo.com
Amstrad CPC 6128
Martín Vigo
La abadía del crimen

3. Background

4. Why
012-XXX-XX89
Ebay
0XX-XXX-6789
Paypal
0XX-XXX-XX89
Yahoo
XXX-XXX-6789
LastPass
XXX-XXX-XX89
Google, Twitter, Microsoft, Steam
Phone number digits scrapping from password resets
012-XXX-6789
Ebay + Paypal
Ebay + Lastpass
0XX-XXX-6789
Yahoo + Lastpass

5. How
253-XXX-9123
1.ebay gives us area code
2.Paypal gives us subscriber number
3.NANPA gives us 458 valid exchange numbers for the area code ‘253’
4.NPA gives us 13 unassigned exchange numbers for the block number ‘9’
Only 445 possible numbers left!!
————— —
[email protected] with ebay and Paypal account
Leverage the country’s “Phone numbering plan” public data

6. What
email2phonenumber
1.Harvests phone number digits from major sites
2.Generates valid phone number lists from partial numbers based on the country’s
Phone Numbering Plan
3.Bruteforces phone number password reset and correlate masked emails with victim’s
github.com/martinvigo/email2phonenumber

7. 1.Harvests phone number digits from major sites
2.Generates valid phone number lists from partial numbers
based on the country’s Phone Numbering Plan
3.Bruteforces phone number password reset and correlate masked emails with victim’s

8. Phonerator
An advanced *valid* phone number generator

9. Phonerator
1.Cleans, formats, sorts and categorizes
phone numbering plan data
2.Multi-country support
3.Extended phone number information
4.Advanced data
fi
filtering
5.Multi-format download
martinvigo.com/tools/phonerator

10. Use cases

11. OSINT
Got your target’s email and you want the phone number
Obtain digits via password reset and use
phonerator to reduce the list of possible numbers
Optionally, reduce the list even further with
additional intel
Bruteforce password resets over phone numbers
and compare emails

12. Investigations
Want to find the identity of a target but you just
have some phone digits
Use phonerator to obtain a list of
possible numbers
Export as txt and feed into into Twilio’s
lookup API with reverse lookup add-on

13. Contact discovery
abuse
Your target uses Signal to
communicate.
Use phonerator to reduce the
list of valid phone number and
download list in VCF format to
import contacts in burner phone

14. Wardialing
Target company owns 415-202 numbers
Use phonerator to obtain a list of
valid numbers for that particular
area code + exchange, download
as txt and feed it into your
favorite wardialing tool

15. Research
Want to dig into carriers
Use phonerator to find
unknown and obscure
carriers together with their
assigned phone numbers

16. CTF

17. Where in the world is Carmen Sandiego?
Carmen has escaped again and I need your help to locate her. Thanks to my friends at NSA I got
access to the SS7 network and I can find her if we obtain her phone number. They were able to
obtain a leak from a secure communications service she was using that contained her email address
and a hashed version of her phone number + city she connected from. Unfortunately, it was hashed
with 5 million rounds of PBKDF2. We estimate that bruteforcing in a reasonable amount of time is
only feasible having the correct city and less than 500 numbers. The NSA warned me that OPSEC is
utterly important. Do not attempt to reset any passwords. It won’t help you find any useful
information and she will know we are tracking her. Find her phone number!
[email protected]
a599f5e85a15799c5fa0a11887dbfc9ebd4de92e0ebbac6768dec60377454ab1
#!/usr/bin/python3
import hashlib
import binascii
##
# Takes phonenumber without country code nor spaces. Example: 5551234567
# Takes city lowercase without spaces. Example: sanfrancisco
##
def get_phone_hash(phonenumber, city):
stringInput = phonenumber + city;
binhash = hashlib.pbkdf2_hmac('sha256', stringInput.encode("utf-8"), b'',
5000000);
return binhash.hex();

18. Thanks!
@martin_vigo
martinvigo.com
linkedin.com/in/martinvigo
github.com/martinvigo
youtube.com/martinvigo
tierradehackers.com