Ni ceros ni unos ...

The last day I said that now we're going to automate all VoIP tasks trying to build a VoIP/UC vulnerability scanner. But I realized that there are some other tasks which I need in each penetration test that we could add too. This way we could avoid to use another tools for an important part of the work. Normally, we're hired to deploy a VoIP specific penetration test, but we also like to check (in a minimal way) the rest of implied services. So I've added next modules brute-force modules: Asterisk AMI : It was a must because this is a very common scenario. MySQL : The most common DB engine among VoIP servers. MongoDB : It's not used in VoIP, but I've been playing lately with this system and I really like it. So I decided also to add a module. SSH / (S)FTP : More common protocols. HTTP(S) : Useful when we find a web management panel for a VoIP server. TFTP : Widely used in VoIP to auto-provisioning the softphones of an organization. LDAP : Sometimes the V...

I've just pushed the last changes to Bluebox-ng repo to get what we consider a beta version. It's not yet finished but it's much more stable than the previous release. Here there is a resume of the changelog: IPv6 support. I would like to thank Olle E. Johansson ( @oej ) because of his research in SIP and IPv6 , it did my work really easy. Exploitsearch.net  API support. DNS module finished. Nicer outputs. Simpler setup process. A network host/port scanner ( Evilscan ). Dirscan-node  upgraded to version 0.5. Added some numerical lists (with different paddings) to use with brute-force modules. Host list files and port ranges support included in SipScan module. Solved SipBrutePass module problem with too much asyncronous requests. A lot of refinements in the whole code. I want to say that we've decided to re-define the project like a "VoIP/UC vulnerability scanner", this way we can work more focused. Our idea is to write a tool to test in an ...

Finally I've pushed the first Alpha version of Bluebox-ng to my GitHub repo:  https://github.com/jesusprubio/bluebox-ng Features RFC compliant TLS and IPv6 support SIP over websockets (and WSS) support (draft-ietf-sipcore-sip-websocket-08) SHODAN and Google Dorks SIP common security tools (scan, extension/password bruteforce, etc.) REGISTER, OPTIONS, INVITE, MESSAGE, SUBSCRIBE, PUBLISH, OK, ACK, CANCEL, BYE and Ringing requests support Authentication through different types of requests. SIP denial of service (DoS) testing SRV and NAPTR discovery Dumb fuzzing Common VoIP servers web management panels discovery Automatic exploit searching (Exploit DB, PacketStorm, Metasploit) Automatic vulnerability searching (CVE, OSVDB) Geolocation Colored output Command completion GNU/Linux, Mac OS X and Windows I'm sorry but we still do not have documentation about the tool. For now, we have the README file included in the source code (which shows the steps to start...

Hi again guys, here there is my new personal project. I think that README file is complete enough so I paste it on this post. Next month I'll be with my colleague Antón  at Kamalio World Conference showing a bit more about it. If you are there and want to talk a bit about VoIP security (or WebRTC) get in contact with us please. :) Finally, we would like to publish the first version in one ore two months, sorry but we're developing it mostly in our free time :(. I've promised Yago to do it on Security by Default blog so stay tuned.  Moreover this tool was included in Quobis personal project plan so you can always follow Quobis planet in which we publish all our experiments. Nothing else, I hope you like it and all kind of suggestions (and coders) are welcomed :). Bluebox-ng Bluebox-ng is a next generation UC/VoIP security tool. It has been written in CoffeeScript using Node.js powers. This project is "our 2 cents" to help to improve ...

I have spent some time analyzing which could be the best way to protect a privative version of a webphone based on QoffeeSIP that we are developing now at Quobis . I have seen this same question on different sites with quite confusing responses. So I'm going to share what I learned just in case it could help to anybody. Well, I'm not going to define what is WebRTC because Internet is full of it this year ( only overtaken by cats ;). For our purposes we have to consider that our app is a Javascript library. Really there is also HTML/CSS code but what I think that is important is Javascript, but HTML/CSS can also be protected in the same way but with other tools. First of all I want to remark that protect your code in the sense of anybody could copy/modify and redistribute it is impossible since Javascript is only text. If anybody had enough time (or money) this code could be reversed. But, as always, we can do things trying to avoid it as far as possible. In general, I ...

Some days ago my friend  @pepeluxx  wrote  another post  about INVITE attacks. He spoke about a  @sinologic   project  which allows to everybody passing some security tests to SIP servers. Furthermore he also published a perl script to do the same task. So I implemented it on Metasploit because I think It could be really useful during a pentesting. It’s interesting because these attacks are really dangerous, normally, attackers try to call to expensive locations. This target numbers often have special charges and they make money with this. Here there are two well known examples: http://blog.sipvicious.org/2010/12/11-million-euro-loss-in-voip-fraud-and.html http://snapvoip.blogspot.com.es/2009/02/calls-to-cuba-and-voip-attacks.html I’m not going to deep in this vector because of being a well known (and old!!) one. Basically the attacker tries to make a call using a misconfigured PBX. This is allowed because  SIP RFC  says that an ...

Some weeks ago we published QoffeeSIP , the Javascript SIP over websockets stack which we use to develop our WebRTC products in Quobis . An example is IdentityCall , a system designed to provide call authentication in traditional VoIP and IMS environments. Now it achieves the same goal in WebRTC ones, interconnecting them at the same time with PSTN network. Today I’m showing a different case of use that those proposed in examples (the "simplest-example" and a "webphone" ). I’m going to write a simple (but for sure the first one in the world ;) SIP over websockets server scanner . It should send a valid SIP (over websockets) petition, parse the interesting info from the response ( i.e. "User-Agent" ) and print it. I’m using the simplest example as basis, here there are the description of the changes I made on the code: - In this case no HTML video tags are provided to the constructor. The reason is that we are only using websocket features of the stack,...

Hi again, while I was checking some demos for our class at Vigo University representing Quobis  I noticed that Metasploit options.rb module (SIP scanning) wasn't working ok. I mean, it was unable to recognize a Kamailio server. Next two pictures show the difference with SIPVicious output: Some time ago, I wrote a post about this module and I remember being a bit surprised because the code doesn't respect SIP protocol at all (but It worked with Asterisk). After a quick view to Kamailio logs my suspects were confirmed, Sanity module was doing right its job dropping these packets. :) Next function defines how requests are created in actual module, If you are familiar with SIP RFC  you probably will notice what I'm talking about. If not, I suggest you to compare it with my  create_request  function of sipflood.rb module.     def create_probe(ip)         suser = Rex::Text.rand_text_alphanumeric(rand(8)+1) ...

Hi, some time ago I published this post about VoIP information gathering with Metasploit. For a minimal pentesting process, a module capable of bruteforcing discovered extensions password is needed. So I have developed it, if you know SIPvicious suite this module provides sipcrack tool features. Based on available SIP related modules I implemented SIP Digest Authentication algorithm and Msf::Auxiliary::AuthBrute mixin does the magic with possible user/password combinations. This picture shows an example of use in which extension 100 password is discovered ( 100 ). Source code: UDP version TCP version In case you use the module outside a LAN is strongly recommended to add you external IP address (option "EXTIP"), trying to avoid SIP and NAT problems. Bye ;)

Hi, it has been a long time since my last post because of my new job and my final year project ("VoIP denegation of service attacks" for curious) but there is something I found during my tests with  Freeswitch ,  Kamailio  and  Asterisk  that I want to share. NOTE: Really, guys of  Security By Default  blog published us (my good friend Roi Mallo and me) two articles about how to develop modules for Metasploit framework, another two are coming.  ;) During my project, among others, I developed a Metasploit module which can flood SIP protocol with common frames (INVITE, OPTIONS, REGISTER, BYE), I wrote it at Quobis (nice job ;) in order to use it for some private tests because actual software didn´t fit our needs, so we are going to probe how is the behavior of different GPL VoIP servers against this kind of attacks: - Asterisk: I think it needs no introduction, the famous softswitch/PBX software. - Freeswitch: It´s a newer soft...

En el artículo anterior explicaba como preparar el entorno de trabajo necesario para desarrollar aplicaciones de red utilizando los framework J2EE, Eclipse y Apache MINA. Un buen punto de partida es como siempre la "Quick start guide" del proyecto , en ella se explican los pasos básicos para la construcción de una aplicación con MINA, en este caso a través del ejemplo del servidor de hora probado con anterioridad, no tiene sentido explicar ese mismo ejemplo así que me centraré en el servidor reverser que es muy similar. No entraré en los parámetros de los métodos de las clases, para eso tenemos la API, ni en el funcionamiento interno del framework, en la guía de usuario que aunque no está completa todavía, sí aborda algo el tema en el apartado 2 . Como comenté en la entrada anterior solo daré algunas nociones que puedan ayudar a alguien intentando que esto sea un complemento a la documentación oficial del proyecto ya que solo se explica el código de algún ejemplo y no exis...