Skip to content

SIPVicious OSS has been around since 2007 and is actively updated to help security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against phone systems especially through identification, scanning, extension enumeration and password cracking.

License

EnableSecurity/sipvicious

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

Fixed digest auth issue due to target misimplementation (lack of `noncecount`)
fd3e7c7

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Welcome to SIPVicious OSS security tools

SIPVicious mascot

SIPVicious OSS is a set of security tools that can be used to audit SIP based VoIP systems. Specifically, it allows you to find SIP servers, enumerate SIP extensions and finally, crack their password.

To get started read the following:

For usage help make use of -h or --help switch.

A note to vendors and service providers

If you are looking for a professional grade toolset to test your RTC systems, please consider SIPVicious PRO.

The tools

The SIPVicious OSS toolset consists of the following tools:

  • svmap
  • svwar
  • svcrack
  • svreport
  • svcrash

svmap

this is a sip scanner. When launched against
ranges of ip address space, it will identify any SIP servers 
which it finds on the way. Also has the option to scan hosts 
on ranges of ports.

Usage: <https://github.com/EnableSecurity/sipvicious/wiki/SVMap-Usage>

svwar

identifies working extension lines on a PBX. A working 
extension is one that can be registered. 
Also tells you if the extension line requires authentication or not. 

Usage: <https://github.com/EnableSecurity/sipvicious/wiki/SVWar-Usage>

svcrack

a password cracker making use of digest authentication. 
It is able to crack passwords on both registrar servers and proxy 
servers. Current cracking modes are either numeric ranges or
words from dictionary files.

Usage: <https://github.com/EnableSecurity/sipvicious/wiki/SVCrack-Usage>

svreport

able to manage sessions created by the rest of the tools
and export to pdf, xml, csv and plain text.

Usage: <https://github.com/EnableSecurity/sipvicious/wiki/SVReport-Usage>

svcrash

responds to svwar and svcrack SIP messages with a message that
causes old versions to crash. 

Usage: <https://github.com/EnableSecurity/sipvicious/wiki/SVCrash-FAQ>

Installation

Please refer to the installation documentation.

Further information

Check out the wiki for documentation.

About

SIPVicious OSS has been around since 2007 and is actively updated to help security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against phone systems especially through identification, scanning, extension enumeration and password cracking.

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published