Ni ceros ni unos ...

I've just pushed the last changes to Bluebox-ng repo to get what we consider a beta version. It's not yet finished but it's much more stable than the previous release. Here there is a resume of the changelog: IPv6 support. I would like to thank Olle E. Johansson ( @oej ) because of his research in SIP and IPv6 , it did my work really easy. Exploitsearch.net  API support. DNS module finished. Nicer outputs. Simpler setup process. A network host/port scanner ( Evilscan ). Dirscan-node  upgraded to version 0.5. Added some numerical lists (with different paddings) to use with brute-force modules. Host list files and port ranges support included in SipScan module. Solved SipBrutePass module problem with too much asyncronous requests. A lot of refinements in the whole code. I want to say that we've decided to re-define the project like a "VoIP/UC vulnerability scanner", this way we can work more focused. Our idea is to write a tool to test in an ...

Finally I've pushed the first Alpha version of Bluebox-ng to my GitHub repo:  https://github.com/jesusprubio/bluebox-ng Features RFC compliant TLS and IPv6 support SIP over websockets (and WSS) support (draft-ietf-sipcore-sip-websocket-08) SHODAN and Google Dorks SIP common security tools (scan, extension/password bruteforce, etc.) REGISTER, OPTIONS, INVITE, MESSAGE, SUBSCRIBE, PUBLISH, OK, ACK, CANCEL, BYE and Ringing requests support Authentication through different types of requests. SIP denial of service (DoS) testing SRV and NAPTR discovery Dumb fuzzing Common VoIP servers web management panels discovery Automatic exploit searching (Exploit DB, PacketStorm, Metasploit) Automatic vulnerability searching (CVE, OSVDB) Geolocation Colored output Command completion GNU/Linux, Mac OS X and Windows I'm sorry but we still do not have documentation about the tool. For now, we have the README file included in the source code (which shows the steps to start...

Hi again guys, here there is my new personal project. I think that README file is complete enough so I paste it on this post. Next month I'll be with my colleague Antón  at Kamalio World Conference showing a bit more about it. If you are there and want to talk a bit about VoIP security (or WebRTC) get in contact with us please. :) Finally, we would like to publish the first version in one ore two months, sorry but we're developing it mostly in our free time :(. I've promised Yago to do it on Security by Default blog so stay tuned.  Moreover this tool was included in Quobis personal project plan so you can always follow Quobis planet in which we publish all our experiments. Nothing else, I hope you like it and all kind of suggestions (and coders) are welcomed :). Bluebox-ng Bluebox-ng is a next generation UC/VoIP security tool. It has been written in CoffeeScript using Node.js powers. This project is "our 2 cents" to help to improve ...

Some weeks ago we published QoffeeSIP , the Javascript SIP over websockets stack which we use to develop our WebRTC products in Quobis . An example is IdentityCall , a system designed to provide call authentication in traditional VoIP and IMS environments. Now it achieves the same goal in WebRTC ones, interconnecting them at the same time with PSTN network. Today I’m showing a different case of use that those proposed in examples (the "simplest-example" and a "webphone" ). I’m going to write a simple (but for sure the first one in the world ;) SIP over websockets server scanner . It should send a valid SIP (over websockets) petition, parse the interesting info from the response ( i.e. "User-Agent" ) and print it. I’m using the simplest example as basis, here there are the description of the changes I made on the code: - In this case no HTML video tags are provided to the constructor. The reason is that we are only using websocket features of the stack,...

Hi again, while I was checking some demos for our class at Vigo University representing Quobis  I noticed that Metasploit options.rb module (SIP scanning) wasn't working ok. I mean, it was unable to recognize a Kamailio server. Next two pictures show the difference with SIPVicious output: Some time ago, I wrote a post about this module and I remember being a bit surprised because the code doesn't respect SIP protocol at all (but It worked with Asterisk). After a quick view to Kamailio logs my suspects were confirmed, Sanity module was doing right its job dropping these packets. :) Next function defines how requests are created in actual module, If you are familiar with SIP RFC  you probably will notice what I'm talking about. If not, I suggest you to compare it with my  create_request  function of sipflood.rb module.     def create_probe(ip)         suser = Rex::Text.rand_text_alphanumeric(rand(8)+1) ...

Hi, I´m scanning a large number of ranges with Sipvicious (" svmap.py ") and I would like to share some tips which helped me during the process: - The use of sessions (-s) and reports ("svreport.py") is necessary to prevent mixing of obtained data. - It´s a good idea to scan not only port 5060, you should add successive ports because some sysadmins configure their SIP services to run there (-p5060-5065). - There is a well known "problem" about SIP and NAT, if you have installed an Asterisk you have heard about it sure :(, so we need to specify our external IP address to Sipvicious with (-x) parameter. Moreover port 5060(Sipvicious outcoming port) has to be forwarded to host which is scanning, in case that you were scanning with more than one instance at the same time successive ports should be forwarded too. I usually put the host int the DMZ trying to avoid these problems. - "svreport.py" tries to make a DNS lookup with the discovered...

I recently wrote two posts (in Spanish) on Flu-Project blog about my recent experience in Hackmeeting 2011 (MeigHacks) and some of the issues I treated during my lecture , including W3af and SQLMap . These are the links: - De paso por el Hackmeeting 2011 - Badstore, SQLi y otras chicas del montón Jesús Pérez

Information gathering  is the stage of a penetration test when the attacker tries to  collect as much information as possible about the target. This step is normally composed for footprinting and fingerprinting but, in the case of VoIP systems, we should add extension enumeration to the list. During this last step attacker will attempt to obtain valid extensions/users of the target system. Footprinting & Fingerprinting My favourite tools for these jobs are FOCA and Nmap , it´s a bit strange combination but it fits for me :). FOCA automates almost all the “dirty job” and it is the best with public documents metadata, while Nmap flexibility let me confirm manually all these discovered stuff. Moreover, in the case of SIP Protocol, FOCA also is able to obtain more information from target   DNS SRV records , they work in a similar way during a call that MX ones for mailing. Next picture taken from the blog of its “father” shows an example of them. Figure: ...