pentesting-voip

Enumerate SIP extensions by sending REGISTER or INVITE requests and observing response codes: 401/407 indicates a valid extension while 404/403 indicates an invalid one. Tools like svwar and sippts exten automate this differential analysis across extension ranges such as 100-300.

Crack SIP REGISTER authentication using svcrack or sippts rcrack with a wordlist against enumerated extensions. For captured digests, extract them with sipdump from a pcap and crack offline using sipcrack or hashcat mode 11400 for SIP MD5 hashes.

Common VoIP pentest tools include nmap sip-methods NSE for discovery, SIPVicious (svmap, svwar, svcrack) for mapping and cracking, sippts for scanning and exploitation, and Wireshark or ucsniff for RTP traffic analysis. hashcat handles offline digest cracking.

Yes, unauthenticated INVITE toll fraud occurs when Asterisk is misconfigured with allowguest=true or a default context including external routes. An attacker can place or transfer calls billed to the victim, verifiable when sippts invite returns 100 Trying or 200 OK without an auth challenge.

RTP eavesdropping works when calls use plain RTP without SRTP or ZRTP encryption, allowing captured media streams to be replayed as intelligible audio. Attackers can also extract DTMF tones from the audio to recover voicemail PINs using tools like multimon.

VoIP testing should only occur during authorized engagements with explicit permission, since toll fraud and call interception carry legal liability. Avoid active INVITE testing on production PBXs during business hours, as brute forcing and test calls can disrupt live telephony services.