Here are a few VOIP Info tutorials I have picked up in the last few days
they are hosted on mediafire.com There are 3 .PDF files in one folder


I am currently finishing up a thread that I will post with lots of info about VOIP on the Back|Track Forums.

Sipvicious

There is mention of my tutorial over on the Sipvicious website.
Nothing special just mentions the tutorial and the fix for the tool in Back|Track 3 beta on the
Back|Track Wiki

Special thanks to Sandro Gauci for making this tool and sharing it with the community.

Small SipVicious Guide

Small SipVicious Guide

This is a small guide on getting the SipVicious tool pack

SIPVicious suite is a set of tools that can be used to audit SIP based systems. It currently consists of four tools:

* svmap - this is a sip scanner. Lists SIP devices found on an IP range
* svwar - identifies active extensions on a PBX
* svcrack - an online password cracker for SIP PBX
* svreport - manages sessions and exports reports to various formats


The home page is located here: Blog

The code is here: Code

SipVicious requires python 2.4 or greater. For BT2 and 3 beta you have this so no need to worry.

There is a video tutorial that will help you out on setting it up and a small walk through using the tools located here:
Video
This video uses the tools found on the Getting Started page below.

There is also a page with info on setting up a VMware player and Trixbox image to use SipVicious against located here:
GettingStarted

The whole thing is pretty straightforward and easy to use.

Have fun with your SIP auditing!

Special thanks to Sandro Gauci for making the tools and video!

How to for List-Urls

How to for List-Urls

Disclaimer this is for education purposes only and not to commit a crime, you are on your own!!
All address have been changed!!

This is a quick guide to using the python script for List-Urls
This is a tool that I believe was written by Muts however I am not 100% sure of this.
To access this tool use the K menu Backtrack|Vulnerabilty Identification|Web Analysis|List-Urls

This opens a shell that looks like the following

Code:

+++++++++++++++++++++++++++++++++++++++++++++++++++++
Extract links form webpage - v.0.1
+++++++++++++++++++++++++++++++++++++++++++++++++++++

Usage : ./list-urls.py 
Eg: ./list-urls.py http://www.whoppix.net

+++++++++++++++++++++++++++++++++++++++++++++++++++++
bt list-urls #

Now in order for us to use this we need a target website I will be using http://www.victimluser.com
Now lets execute this script against our target
at the prompt type ./list-urls.py http://www.victimluser.com
It should look like the following.

Code:

bt list-urls # ./list-urls.py http://www.victimluser.com
##########################################################
#                                                       #
#            Extract URLS from a web page               #
#            email removed for spam control             #
#                                                       #
##########################################################

index.html
news.html
lusers.html
victims.html
disclaimer.html
http://www.victimluser.com
bt list-urls #

Ok now we have seen what success looks like.
The next one shows what our target actually looks like since this is not a real target but a fake one.

Code:

bt list-urls # ./list-urls.py http://www.victimluser.com

##########################################################
#                                                       #
#            Extract URLS from a web page               #
#            email removed for spam control             #
#                                                       #
##########################################################

Could not reach http://www.victimluser.com !
Did you remember to put an http:// before the domain name?
bt list-urls #

DNSMap Tutorial

DNSMap Tutorial

This tutorial will show you how to use DNSMap


Disclaimer: This is for educational purposes only not for committing a crime you are on your own!
All IP's have been changed.

Background: Dnsmap is a small C based tool that perform brute-forcing of domains. The tool can use an internal wordlist, or work with an external dictionary file.
Info: http://ikwt.dyndns.org/ This site seems to be down.
(Source http://backtrack.offensive-security....p/Tools#dnsmap )

Ok now to acccess the tool go to K Menu | Backtrack | Information Gathering | DNS| DNSMap


Ok it will open a shell and show you

Code:

dnsmap - DNS Network Mapper by pagvac
(http://ikwt.com, http://foro.elhacker.net)
Usage: dnsmap  [dictionary-file]
Examples:
dnsmap yourtarget.com
dnsmap yourtarget.com yourwordlist.txt

bt dnsmap #

Once you have it open you can check the readme by doing a nano README This will provide lots more info.
Be sure to read it there are some limitations when using this tool.

Next we need to give dnsmap a target to search again we will use http://www.victimluser.com
so

Code:

bt dnsmap # victimluser.com

This will return us with:

Code:

dnsmap - DNS Network Mapper by pagvac
(http://ikwt.com, http://foro.elhacker.net)
Searching subhosts on domain victimluser.com

forum.victimluser.com
IP Address #1:192.168.1.1

mail.victimluser.com
IP Address #1:192.168.1.2

ftp.victimluser.com
IP Address #1:192.168.1.3

pop.victimluser.org
IP Address #1:192.168.1.4

Also you can create a wordlist.txt that you can supply at the command line like this

Code:

 bt dnsmap # dnsmap targetdomain.com wordlist.txt

This will force dnsmap to use a supplied wordlist to bruteforce subdomains if you do not supply a wordlist then dnsmap
will use the built in one by default.

The readme also give links to a few wordlist you can download.

Voiphopper How To

This is a small howto on installing voiphopper version 0.9.7

"VoIP Hopper is the answer to all voip solution providers who make people believe that VLANS is all you need to secure VoIP" - Sachin Joglekar, Sipera VIPER Lab

"VoIP Hopper is a GPLv3 licensed security tool, written in C, that rapidly runs a VLAN Hop into the Voice VLAN on specific Ethernet switches. VoIP Hopper does this by mimicking the behavior of an IP Phone, in both Cisco and Avaya IP Phone environments."

(SOURCE = Voiphopper readme.txt )

This tool was released at shmoocon this past weekend.

voiphopper

Download and save( I saved mine to "/root") Then use:

Code:

bt ~# tar xvfz voiphopper-0.9.7.tar.gz

This will "untar" and "ungzip" the package.

Code:

bt ~ # tar xvfz voiphopper-0.9.7.tar.gz
voiphopper-0.9.7/
voiphopper-0.9.7/Makefile
voiphopper-0.9.7/arp.c
voiphopper-0.9.7/buildmsg.c
voiphopper-0.9.7/cache.c
voiphopper-0.9.7/client.c
voiphopper-0.9.7/dhcpconfig.c
voiphopper-0.9.7/mac.c
voiphopper-0.9.7/netinfo.c
voiphopper-0.9.7/peekfd.c
voiphopper-0.9.7/signals.c
voiphopper-0.9.7/udpipgen.c
voiphopper-0.9.7/voiphopper.c
voiphopper-0.9.7/buildmsg.h
voiphopper-0.9.7/client.h
voiphopper-0.9.7/dhcpcd.h
voiphopper-0.9.7/kversion.h
voiphopper-0.9.7/mac.h
voiphopper-0.9.7/maclist.h
voiphopper-0.9.7/netinfo.h
voiphopper-0.9.7/pathnames.h
voiphopper-0.9.7/signals.h
voiphopper-0.9.7/udpipgen.h
voiphopper-0.9.7/LICENSE
voiphopper-0.9.7/README

Next "cd" to the directory where you saved it

Code:

bt ~# cd/root/voiphopper-0.9.7 #

and then use "make" to install it

Code:

 bt ~# cd/root/voiphopper-0.9.7 # make

You should see the following as the output

Code:

INSTALLATION
bt  voiphopper-0.9.7 # make
gcc -c voiphopper.c
gcc -c dhcpconfig.c
gcc -c buildmsg.c
gcc -c cache.c
gcc -c udpipgen.c
gcc -c peekfd.c
gcc -c client.c
gcc -c arp.c
gcc -c signals.c
gcc -c mac.c
gcc -c netinfo.c
gcc voiphopper.o dhcpconfig.o buildmsg.o cache.o udpipgen.o peekfd.o client.o arp.o signals.o mac.o netinfo.o -lpcap -o voiphopper
bt voiphopper-0.9.7 #

Usage looks like the following:

1. To sniff for CDP and run a VLAN Hop into the Voice VLAN, simply run VoIP Hopper on the Ethernet interface, in the following way:

Code:

voiphopper -i eth1

2. VoIP Hopper also allows one to VLAN Hop to an arbitrary VLAN, without sniffing for CDP. If you already know the Voice VLAN ID, or would like to VLAN Hop into another VLAN (without sniffing for CDP), you can run it in the following way:

Code:

voiphopper -i eth1 -v 200

3. To Discover the Voice VLAN in an Avaya IP Phone environment:

Code:

voiphopper -i eth1 -a

4. To spoof the MAC Address of an IP Phone by sniffing for CDP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -m AA:AA:AA:AA:AA:AA

5. To spoof the MAC Address of an IP Phone using an Avaya DHCP request (this changes the MAC address of default interface and new interface) :

Code:

voiphopper -i eth1 -a -m AA:AA:AA:AA:AA:AA

6. To spoof the MAC Address of an IP Phone by VLAN Hopping without CDP or DHCP (this changes the MAC address of default interface and new interface):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA

7. To spoof the MAC Address of an IP Phone without changing the MAC Address of the default ethernet interface (only spoof the new voice interface's MAC Address):

Code:

voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA -D

(SOURCE = Voiphopper readme.txt )

Well I hope that helps you get started
Have fun and play nice
This tutorial is not all of my own work credits to:
AUTHOR
Jason Ostrom
And the other Developers.

How to Using MTR

How to Using MTR

Background:

MTR combines the functionality of the traceroute and ping programs in a single net-work diagnostic tool.
As mtr starts, it investigates the network connection between the host mtr runs on
and HOSTNAME. by sending packets with purposely low TTLs. It continues to send packets
with low TTL, noting the response time of the intervening routers. This allows
mtr to print the response percentage and response times of the Internet route to
HOSTNAME. A sudden increase in packet-loss or response time is often an indication of
a bad (or simply overloaded) link.

(SOURCE MTR man pages)

Disclaimer: This information is for educational purposes only and not to commit a crime.
I stress the first part because this may get you into trouble with your ISP or Network Admins.
If you do something that causes you to hose your box don't come kicking and screaming on the forums!
All IP and MAC address' have been munged!

First off I did this using BT2 Final but the process is the exact same using BT3 the only change is now there is graphical front-end using GTK+
I am going to show a couple of examples of this tool and leave the rest up to you for now. I may add more later on.

The purpose of this tool is to provide a ping and traceroute utility in one package.
This is good for 1 allowing us to determine if a target is alive and 2 what hops our packets take in order to get to said target.
When Pentesting once we have identified a target on a network we try to learn about other networks that interact with it and this is one of the ways.
This will also help us what else may stand in our way.

To use mtr we need to open a terminal and type at the prompt

Code:

 bt ~ # mtr --help
usage: mtr [-hvrctglspni46] [--help] [--version] [--report]
               [--report-cycles=COUNT] [--curses] [--gtk]
               [--raw] [--split] [--no-dns] [--address interface]
               [--psize=bytes/-s bytes]
               [--interval=SECONDS] HOSTNAME [PACKETSIZE]
bt ~ #

This shows us the usage flags and options.
So in order to know more about the different flags we will take a look at them now:
OPTIONS
-h help
Print the summary of command line argument options.

-v --version
Print the installed version of mtr.

-r --report
This option puts mtr into report mode. When in this mode, mtr will run for
the number of cycles specified by the -c option, and then print statistics and
exit.
This mode is useful for generating statistics about network quality. Note
that each running instance of mtr generates a significant amount of network
traffic. Using mtr to measure the quality of your network may result in
decreased network performance.

-c COUNT --report-cycles COUNT
Use this option to set the number of pings sent to determine both the machines
on the network and the reliability of those machines. Each cycle lasts one
second.

-s BYTES --psize BYTES

PACKETSIZE
These options or a trailing PACKETSIZE on the commandline sets the packet size
used for probing. It is in bytes inclusive IP and ICMP headers

If set to a negative number, every iteration will use a different, random
packetsize upto that number.

-t --curses
Use this option to force mtr to use the curses based terminal interface (if available).

-n --no-dns
Use this option to force mtr to display numeric IP numbers and not try to
resolve the host names.

-g --gtk
Use this option to force mtr to use the GTK+ based X11 window interface (if
available). GTK+ must have been available on the system when mtr was built
for this to work. See the GTK+ web page at
www DOT gimp DOTorg/gtk/for more information about GTK+.

-p --split
Use this option to set mtr to spit out a format that is suitable for a split-
user interface.


-l --raw
Use this option to tell mtr to use the raw output format. This format is better
suited for archival of the measurement results. It could be parsed to be
presented into any of the other display methods.

-a IP.ADD.RE.SS

--address IP.ADD.RE.SS
Use this option to bind outgoing packets' socket to specific interface, so
that any packet will be sent through this interface. NOTE that this option
doesn't apply to DNS requests (which could be and could not be what you want).

-i SECONDS

--interval SECONDS
Use this option to specify the positive number of seconds between ICMP ECHO
requests. The default value for this parameter is one second.

-4
Use IPv4 only.

-6
Use IPv6 only.

Ok now we see that we have lots of options to play with here.

Ok back to the terminal we are going to look at a target computer with the -r (report mode) and -c (count) set to 1 packet

Code:

bt ~ # mtr -r -c 1 www.yourexampletarget.com

To see the output of this command click on the picture here:
output

NOTE: I had to use this picture in order to get the formatting to show up like it would in a shell.

NOTE: we can use both domain names like above or we can use IP address the result is the same.

Ok now let's see what we got back, we only care about the first two columns. The first is the name of the nodes along the route,and the second is the percent of packets that were lost. If we lose packets then the traceroute must find a new way to get to the destination. Sometimes nodes along our route will drop these packets.
So we see that in number 3 above it would seem we lost a packet however the node just dropped it.
But our trace continues until it gets to 13 and the same thing happens. Also this could be the result of a node not advertising itself blindly. Could be good or bad.
And last we arrive at 14 our target network. Remember just like any traceroute the first node returned is the closest to your box and the last is farthest away.
If we are Pentesting we can use a whois command and lookup the network node names above and may learn more about the route our packets take to our target.
This may help us determine if our target is sitting on the edge of the network or not.
Also when doing this if you do not specify the number of packets with the -c flag this process will continue to run until you stop it!
This can be bad depending on the TOS from your ISP or other networks along the route. Generally speaking most admins will not want you repeatedly pinging their networks. Sometimes one or two ping attempts may be ok. At a minimum it is plain rude to needlessly ping a node!


This tutorial should give you enough information to work with MTR.