The articles below have a plethora of data that covers various elements of both phreaking and hacking.
the BT work management system
fdcfed8a6d4e422fbf822e60f9c5a1b4bf9900581a67505160da710158ca3025
gr1ps guide to vms [3 of 3]
a5ebbd6db4f8cf524996b215edf8b9048f4825a299d0cb7b4366adad9d760dcd
gr1ps guide to vms [2 of 3]
a41c9cf3e6e5fb6eed49ceb7a814ad61cf21ef3f039444b94cae69cabbe4f374
gr1ps guide to vms [1 of 3]
8fac25664ff6f9d5783e081efd562e03ca699a79b59fb7ff50f43f2effad4d77
nice list of 800 VMBs
f4f9c64e4a14a83b5eeb4ebcf4ee7d548775c4c37f599835cb0232f0cb9e78a1
UK Switching Systems & line tests
2bf9bab84048873e28d3c3bd4a5b80456387439a98584bca0da70d799754bc88
Intermediate UK Phreakers guide
80a2a16882e45bdba4fbe723c9f84ca8b4a2fab89b6235c60cb1785e0f9d10c6
Time O Matic's system 8000
a2979d6c55e0f7d6cd7e177630ec182deee03fe99338cea5c770c30c73c22973
Telecom. system and structures
3fbe69f89056bd56b254084ca04f6a6637e260b07352e729bead8f443093e72c
BT network admin spt systems development
de965a674bf305d20435815d1fcf47e5453f38b6ccca48f9b7627caacc31f32d
Switched route of tf setup networks
c20699a8a2224d2e26ed76117134ee754dd94b06d6f5943cb6d53c91281ecf8e
South Western Bell codes
374c26a38be9858984b04bbebb1661619005887f36c5777668347d07bfedf211
Local vs. Net hacking
94a451f5ab5b16859f1fcf5d7d776e5a28b0e4063678a808163965cd20ceec36
Skytel Command Refernce Chart
97b7411d3905ed2f737753fcc301c21c3ad01af88b0bba6fc84fce0b9b63fd4e
hacking skytel pager VMBs
8c3c514dd2617ee600dd7153adb4abdebe7f3644d8006c650c591c2e54e2de9c
More info on SecurID
4aedc8f7cac3b5a000adf223ff8494ca855fecb31e89a439bb8db8cf01528a33
Inpho on SecurID
67704e3d45802e175b755dd5e6008f493cc924b1693d0315d794472d810f5da5
Cellular System ID List
db565d05192549b02b3274a3f557d96d76020375edcb4ef0eb5cf6283e1babb4
Info on Signalling
2e81cd211c6a789aebfdb9fc120ce991d6601cb3d0eb5502d35f5028393faac4
SecurID All Over
b0a4f0ba2a083c3c05b2c3f24c9dfec513250e248f7abaa9f3e82a3a86e12c61
Exploring UK Prefix assignment
7cc16485a4eb7e51a0b0d4f033210c76588e9215cbb398a848ff9bc0e04ee4eb
Satellite communications
989a61d7ad0d278cf386bfb8693cc106fbd730c0a352700bfd587999be50e145
Followup to hacking PMs
0f7dd0156bcd4e773a334d492123be0d10e511b71fa915d0b3e271b5a10970c8
Hacking Rolm PhoneMail
dfaf7192043771ba52a4dcaf1ee0cb305bc4cdcda161e92d20ed3641b1da8b48
Some information on ROLM PhoneMail systems
04b060cb77710a9183eab875121931ef763643a8d05642e59b83f7fbc8d16ac8