Sipvicous - security test for SIP

 What

Testing SIP security on new PBX'es.

 Problem

I was looking for a descent security testing tool for SIP.

 Solution

SIPVicious suite is a set of tools that can be used to audit SIP based VoIP systems. It currently consists of four tools:

• svmap - this is a sip scanner. Lists SIP devices found on an IP range
• svwar - identifies active extensions on a PBX
• svcrack - an online password cracker for SIP PBX
• svreport - manages sessions and exports reports to various formats
• svcrash - attempts to stop unauthorized svwar and svcrack scans 

The requirement is that python 2.6 or greater is installed. 

following example shows how to scan an IP adres (private or public)

python ./svmap.py 192.168.2.22
python ./svmap.py 81.82.83.84

If the output shows: WARNING:root:found nothing then everything is ok and your PBX should be secure.

We could use this in a batch script, that asks for the IP address:

@ECHO OFF

set PBX=
set /p PBX=Enter the IP address of the PBX:

%USERPROFILE%\Desktop\Python27\python.exe %USERPROFILE%\Desktop\Python27\sipvicious\./svmap.py %PBX%
pause

For more examples for scanning subnets and cracking actually extensions when the above test has the user agent off the PBX as result, visit the owners website at: http://code.google.com/p/sipvicious/w/list


This little trick will produce an ghost call on your network, imaging that all your sip phones are registered on the same subnet: 192.168.1.1

The command to run would become:

./svmap.py -m INVITE 192.168.1.1/24