There have been some new tools released over the past few days and I would like to put up some basic info on some of them. Here are a few new or newer voip testing tools.

VoIPER0.06
VoIPER is a VoIP security testing toolkit incorporating several VoIP fuzzers and auxilliary tools to assist the auditor. It can currently generate over 200,000 SIP tests and H.323/IAX modules are in development.

SipBomber0.8
SipBomber is sip-protocol testing tool for Linux originally developed by Metalink in 2003 for internal use and released later as GPL open source product.


Sip Rogue
You can find more info about Sip Rogue in the Book Hacking VoIP Exposed.


These tools can be found in the newest version of Back|Track.

How to Setup a Trixbox image using Vmware player

How to Setup a Trixbox image using Vmware player.

This guide will show you how to setup a target PBX machine in your own pentesting lab.
This will allow you to use several tools that are available in BT in order to learn about VOIP.

So this guide will assume a few things.
1. You have at least two computers on some sort of network
2. One of them is capable of running BT
3. The other is running windows xp.

Now if you need help with any of that then see
google

Now in order to get our machine setup we need to download a few things.
1. the player
2. the trixbox image

You need to download the Vmware image titled: trixbox CE 2.6.0.7
There are md5sums for it as well.

Ok now setup the vmware player as per the documentation
Next you will need to unzip the trixbox image.
Once this is done you will need to start the player. Once it opens chose from the commands "open" and navigate to the folder where your recently unzipped folder.
Then find the file that is labeled "trixbox-ce-2.6.0.2" This is the needed image.
Now select open and the OS should start too boot inside of the player. It takes a few minutes to get to the log on prompt.
If there are any errors that prevent you from getting a root log in prompt then you will need to work those out first.
You can post in this thread but I can only offer limited help for this. Best go to the trixbox website.

Now that our OS is booted we can leave it alone.
If you have the desire you can log onto it using
logon:root
password: trixbox

But there is really nothing to see there.
You will do all configuration from the web gui interface.
You should also see on the player the IP address to access this web interface.
If not find the IP of your machine and this will be it.
Ok so on another machine open a browser and navigate to the IP address.

Then once you have the page the next few steps are real easy.
Upper right hand corner find the user mode and switch to maint.
you will need to supply the user and password

User: maint
Password: password

Now it will reload the page. Next find on the left side toward the top "Asterix" and then in the drop down "FreePBX"
Click on it and it reloads. This is the page where we can add our extensions. This is basically the user and there associated phone number.
Just like when you call some business or whatever and the prompt asks for an extension.
Choose in the middle the drop down box that should say "SIP" device.
Then you will need to fill out the following.
The extension number
You should give a name but it is not necessary.
Then down the list you will see "secret" this is the password field put something in there or leave it blank.

Next go to the very bottom and hit the submit button and back up to the top of the page is an orange button for adding the new extension to the database and turning it on.
At this point you are done. If you want to mess with the other features by all means go for it. For our testing purposes we are finished with the web interface.
You can the just navigate to another website or close the browser.


Now in order for us to make use of the SipVicious tools you will need to navigate to the SipVicious directory and add a word list.
The default is "dictionary.txt" At this point you can either add some words or whatever but you need to ensure that your secrets from above are in there.
Save the file and exit.

So to see the video that shows how to set up our trixbox please follow this link it will take you to blip.tv


For more info on using the SipVicious tools see my other tutorial here.

Hope you enjoy it and please leave some feed back!

Abusing VOIP Networks with SipVicious

As promised here is the video uploaded to blip.tv
You can get it here from blip.tv
It is also available from here on media fire for download
It is saved in the ".mpeg" format so you may need some sort of codec to make it work for you.
Hope you enjoy it !

SipVicious Hacking

I did a small video on using the SipVicious tools under Back|Track
I will post more info later at the remote exploits forums.
I will also post a small video on setting up our target machine.
There are two formats for the video a .html and a .swf

The files have been pulled temporarily will repost them later on tonight.

Here are a few VOIP Info tutorials I have picked up in the last few days
they are hosted on mediafire.com There are 3 .PDF files in one folder


I am currently finishing up a thread that I will post with lots of info about VOIP on the Back|Track Forums.

Small SipVicious Guide

Small SipVicious Guide

This is a small guide on getting the SipVicious tool pack

SIPVicious suite is a set of tools that can be used to audit SIP based systems. It currently consists of four tools:

* svmap - this is a sip scanner. Lists SIP devices found on an IP range
* svwar - identifies active extensions on a PBX
* svcrack - an online password cracker for SIP PBX
* svreport - manages sessions and exports reports to various formats


The home page is located here: Blog

The code is here: Code

SipVicious requires python 2.4 or greater. For BT2 and 3 beta you have this so no need to worry.

There is a video tutorial that will help you out on setting it up and a small walk through using the tools located here:
Video
This video uses the tools found on the Getting Started page below.

There is also a page with info on setting up a VMware player and Trixbox image to use SipVicious against located here:
GettingStarted

The whole thing is pretty straightforward and easy to use.

Have fun with your SIP auditing!

Special thanks to Sandro Gauci for making the tools and video!

Voiphopper How To

This is a small howto on installing voiphopper version 0.9.7

"VoIP Hopper is the answer to all voip solution providers who make people believe that VLANS is all you need to secure VoIP" - Sachin Joglekar, Sipera VIPER Lab

"VoIP Hopper is a GPLv3 licensed security tool, written in C, that rapidly runs a VLAN Hop into the Voice VLAN on specific Ethernet switches. VoIP Hopper does this by mimicking the behavior of an IP Phone, in both Cisco and Avaya IP Phone environments."

(SOURCE = Voiphopper readme.txt )

This tool was released at shmoocon this past weekend.

voiphopper

Download and save( I saved mine to "/root") Then use:

Code:

bt ~# tar xvfz voiphopper-0.9.7.tar.gz

This will "untar" and "ungzip" the package.

Code:

bt ~ # tar xvfz voiphopper-0.9.7.tar.gz
voiphopper-0.9.7/
voiphopper-0.9.7/Makefile
voiphopper-0.9.7/arp.c
voiphopper-0.9.7/buildmsg.c
voiphopper-0.9.7/cache.c
voiphopper-0.9.7/client.c
voiphopper-0.9.7/dhcpconfig.c
voiphopper-0.9.7/mac.c
voiphopper-0.9.7/netinfo.c
voiphopper-0.9.7/peekfd.c
voiphopper-0.9.7/signals.c
voiphopper-0.9.7/udpipgen.c
voiphopper-0.9.7/voiphopper.c
voiphopper-0.9.7/buildmsg.h
voiphopper-0.9.7/client.h
voiphopper-0.9.7/dhcpcd.h
voiphopper-0.9.7/kversion.h
voiphopper-0.9.7/mac.h
voiphopper-0.9.7/maclist.h
voiphopper-0.9.7/netinfo.h
voiphopper-0.9.7/pathnames.h
voiphopper-0.9.7/signals.h
voiphopper-0.9.7/udpipgen.h
voiphopper-0.9.7/LICENSE
voiphopper-0.9.7/README

Next "cd" to the directory where you saved it

Code:

bt ~# cd/root/voiphopper-0.9.7 #

and then use "make" to install it

Code:

 bt ~# cd/root/voiphopper-0.9.7 # make

You should see the following as the output

Code:

INSTALLATION
bt  voiphopper-0.9.7 # make
gcc -c voiphopper.c
gcc -c dhcpconfig.c
gcc -c buildmsg.c
gcc -c cache.c
gcc -c udpipgen.c
gcc -c peekfd.c
gcc -c client.c
gcc -c arp.c
gcc -c signals.c
gcc -c mac.c
gcc -c netinfo.c
gcc voiphopper.o dhcpconfig.o buildmsg.o cache.o udpipgen.o peekfd.o client.o arp.o signals.o mac.o netinfo.o -lpcap -o voiphopper
bt voiphopper-0.9.7 #

Usage looks like the following:

1. To sniff for CDP and run a VLAN Hop into the Voice VLAN, simply run VoIP Hopper on the Ethernet interface, in the following way:

Code:

voiphopper -i eth1

2. VoIP Hopper also allows one to VLAN Hop to an arbitrary VLAN, without sniffing for CDP. If you already know the Voice VLAN ID, or would like to VLAN Hop into another VLAN (without sniffing for CDP), you can run it in the following way:

Code:

voiphopper -i eth1 -v 200

3. To Discover the Voice VLAN in an Avaya IP Phone environment:

Code:

voiphopper -i eth1 -a

4. To spoof the MAC Address of an IP Phone by sniffing for CDP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -m AA:AA:AA:AA:AA:AA

5. To spoof the MAC Address of an IP Phone using an Avaya DHCP request (this changes the MAC address of default interface and new interface) :

Code:

voiphopper -i eth1 -a -m AA:AA:AA:AA:AA:AA

6. To spoof the MAC Address of an IP Phone by VLAN Hopping without CDP or DHCP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA

7. To spoof the MAC Address of an IP Phone without changing the MAC Address of the default ethernet interface (only spoof the new voice interface's MAC Address):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA -D

(SOURCE = Voiphopper readme.txt )

Well I hope that helps you get started
Have fun and play nice
This tutorial is not all of my own work credits to:
AUTHOR
Jason Ostrom
And the other Developers.