User manual

23
username/password files for PhoneSweep to use (please see Section 6.2, Importing Brute Force
Information.)
• systemdefault.txt: This file contains a master list of default user name/passwords used by many
common operating systems, that you can use as a resource to verify that the default user
name/password setting on the systems in your workplace have been changed.. To use this file,
you search it for the lines containing information on systems found on your network, then copy
and paste the relevant lines into the bruteforce.txt or a new document that you can import as a
user name/password source.
• brutecreate.exe: This MS-DOS command line utility combines usernames and passwords from
separate files to add or replace the contents of the bruteforce.txt file. You can use the following
password source files in combination with your own USERID sources files to customize
bruteforce.txt with brutecreate.exe:
o largebrute.txt: This file contains a dictionary of passwords that hackers commonly use.
o largebruteback.txt: This file contains the same dictionary words as largebrute.txt, but
each of them is backwards.
2.7.1 Username/password recycling
During Penetrate-level ( ) sweeps, username/password combinations can be recycled (used once
against every modem PhoneSweep encounters), or not recycled (used only once during a scan, on the
assumption that all modems share the same username/password database).
Not recycling usernames/passwords reduces the total number of calls that need to be made, and is
recommended when all phone numbers being swept are connected to the same system. On the other hand,
specifying that PhoneSweep should recycle username/password combinations will cause the scan to take
longer, but make the scan more complete
For more information on when username/password recycling is useful and appropriate, see Section 4.6.2,
Username/password recycling.
2.8 Importing and Exporting PhoneSweep Data
PhoneSweep is capable of importing and exporting several types of data.
You can enter phone numbers in a different program and have PhoneSweep import them. Imported phone
numbers must be in text files and in one of the following formats.
• <phone number> <Tab> <time period code> <CRLF>
• <phone number> <Comma Space> <time period code> <CRLF>
• <phone number> <Space Space> <time period code> <CRLF>
• “<phone number”> <comma>”<time period code>”<CLRF>
To import a file containing a list of phone numbers, click on the Import button. When the Import
Dialog box appears, enter the name of the file containing the list of phone numbers, select the Phone
numbers Import Option, and then click OK. See Section 6.1, Importing Phone Number Lists, for more
information.
You can also import Username/password combinations for use in the Penetrate level of effort using
the Import button. For more information, see Section 6.2.