Ni ceros ni unos ...

Some weeks ago we published QoffeeSIP , the Javascript SIP over websockets stack which we use to develop our WebRTC products in Quobis . An example is IdentityCall , a system designed to provide call authentication in traditional VoIP and IMS environments. Now it achieves the same goal in WebRTC ones, interconnecting them at the same time with PSTN network. Today I’m showing a different case of use that those proposed in examples (the "simplest-example" and a "webphone" ). I’m going to write a simple (but for sure the first one in the world ;) SIP over websockets server scanner . It should send a valid SIP (over websockets) petition, parse the interesting info from the response ( i.e. "User-Agent" ) and print it. I’m using the simplest example as basis, here there are the description of the changes I made on the code: - In this case no HTML video tags are provided to the constructor. The reason is that we are only using websocket features of the stack,...

Hi again, while I was checking some demos for our class at Vigo University representing Quobis  I noticed that Metasploit options.rb module (SIP scanning) wasn't working ok. I mean, it was unable to recognize a Kamailio server. Next two pictures show the difference with SIPVicious output: Some time ago, I wrote a post about this module and I remember being a bit surprised because the code doesn't respect SIP protocol at all (but It worked with Asterisk). After a quick view to Kamailio logs my suspects were confirmed, Sanity module was doing right its job dropping these packets. :) Next function defines how requests are created in actual module, If you are familiar with SIP RFC  you probably will notice what I'm talking about. If not, I suggest you to compare it with my  create_request  function of sipflood.rb module.     def create_probe(ip)         suser = Rex::Text.rand_text_alphanumeric(rand(8)+1) ...

My colleague Antón ( @AntonRoman ) and myself visited last Monday the Telecommunication Engineering School at Vigo University in order to give a talk about VoIP, technologies and project that we’re involved in Quobis . As the year before, we were invited by the professor of the subject  “ Switching laboratory”. , Martín López Nores , to prepare a Kamailio practical exercise. Antón started explaining some basic VoIP concepts and then he went through more advanced ones mainly focused in Kamailio SIP server ( slides ).Then, I made a review and a demo of the most common VoIP vector attacks that we found every day “in the wild” and their available countermeasures ( slides ). As the last course, we extended the mandatory practice with an optional exercise (you can download them from the links below): - 2011-2012 - 2012-2013 We encourage the students to give it a try, I strongly think this practice could be very useful for their professional future. In fact,...

Hi, it has been a long time since my last post because of my new job and my final year project ("VoIP denegation of service attacks" for curious) but there is something I found during my tests with  Freeswitch ,  Kamailio  and  Asterisk  that I want to share. NOTE: Really, guys of  Security By Default  blog published us (my good friend Roi Mallo and me) two articles about how to develop modules for Metasploit framework, another two are coming.  ;) During my project, among others, I developed a Metasploit module which can flood SIP protocol with common frames (INVITE, OPTIONS, REGISTER, BYE), I wrote it at Quobis (nice job ;) in order to use it for some private tests because actual software didn´t fit our needs, so we are going to probe how is the behavior of different GPL VoIP servers against this kind of attacks: - Asterisk: I think it needs no introduction, the famous softswitch/PBX software. - Freeswitch: It´s a newer soft...