Ni ceros ni unos ...

I've just pushed the last changes to Bluebox-ng repo to get what we consider a beta version. It's not yet finished but it's much more stable than the previous release. Here there is a resume of the changelog: IPv6 support. I would like to thank Olle E. Johansson ( @oej ) because of his research in SIP and IPv6 , it did my work really easy. Exploitsearch.net  API support. DNS module finished. Nicer outputs. Simpler setup process. A network host/port scanner ( Evilscan ). Dirscan-node  upgraded to version 0.5. Added some numerical lists (with different paddings) to use with brute-force modules. Host list files and port ranges support included in SipScan module. Solved SipBrutePass module problem with too much asyncronous requests. A lot of refinements in the whole code. I want to say that we've decided to re-define the project like a "VoIP/UC vulnerability scanner", this way we can work more focused. Our idea is to write a tool to test in an ...

Finally I've pushed the first Alpha version of Bluebox-ng to my GitHub repo:  https://github.com/jesusprubio/bluebox-ng Features RFC compliant TLS and IPv6 support SIP over websockets (and WSS) support (draft-ietf-sipcore-sip-websocket-08) SHODAN and Google Dorks SIP common security tools (scan, extension/password bruteforce, etc.) REGISTER, OPTIONS, INVITE, MESSAGE, SUBSCRIBE, PUBLISH, OK, ACK, CANCEL, BYE and Ringing requests support Authentication through different types of requests. SIP denial of service (DoS) testing SRV and NAPTR discovery Dumb fuzzing Common VoIP servers web management panels discovery Automatic exploit searching (Exploit DB, PacketStorm, Metasploit) Automatic vulnerability searching (CVE, OSVDB) Geolocation Colored output Command completion GNU/Linux, Mac OS X and Windows I'm sorry but we still do not have documentation about the tool. For now, we have the README file included in the source code (which shows the steps to start...

Hi again guys, here there is my new personal project. I think that README file is complete enough so I paste it on this post. Next month I'll be with my colleague Antón  at Kamalio World Conference showing a bit more about it. If you are there and want to talk a bit about VoIP security (or WebRTC) get in contact with us please. :) Finally, we would like to publish the first version in one ore two months, sorry but we're developing it mostly in our free time :(. I've promised Yago to do it on Security by Default blog so stay tuned.  Moreover this tool was included in Quobis personal project plan so you can always follow Quobis planet in which we publish all our experiments. Nothing else, I hope you like it and all kind of suggestions (and coders) are welcomed :). Bluebox-ng Bluebox-ng is a next generation UC/VoIP security tool. It has been written in CoffeeScript using Node.js powers. This project is "our 2 cents" to help to improve ...

My colleague Antón ( @AntonRoman ) and myself visited last Monday the Telecommunication Engineering School at Vigo University in order to give a talk about VoIP, technologies and project that we’re involved in Quobis . As the year before, we were invited by the professor of the subject  “ Switching laboratory”. , Martín López Nores , to prepare a Kamailio practical exercise. Antón started explaining some basic VoIP concepts and then he went through more advanced ones mainly focused in Kamailio SIP server ( slides ).Then, I made a review and a demo of the most common VoIP vector attacks that we found every day “in the wild” and their available countermeasures ( slides ). As the last course, we extended the mandatory practice with an optional exercise (you can download them from the links below): - 2011-2012 - 2012-2013 We encourage the students to give it a try, I strongly think this practice could be very useful for their professional future. In fact,...

I recently wrote two posts (in Spanish) on Flu-Project blog about my recent experience in Hackmeeting 2011 (MeigHacks) and some of the issues I treated during my lecture , including W3af and SQLMap . These are the links: - De paso por el Hackmeeting 2011 - Badstore, SQLi y otras chicas del montón Jesús Pérez

Ayer estuvimos jugando un poco con SHODAN y me parece interesante dejar aquí plasmados algunos resultados bastante curiosos de las pruebas que fuimos haciendo. Para empezar, ¿qué es SHODAN? Es un buscador, para dar una explicación rápida diremos que en vez de buscar por contenidos como hace Google busca máquinas(servidores, routers, etc) que ejecuten el software que le especifiquemos, además permite filtrar los resultados por otros parámetros como países, puertos o versiones, en este pdf lo explican con más detalle. Un buen punto de partida para familiarizarse con esta aplicación web son las búsquedas populares , entre las que podemos encontrar algunas con resultados muy sorprendentes. Después de un rato trasteando se nos ocurrió buscar routers, ya que con esta lista de contraseñas por defecto (o otra de las muchas que hay por ahí) para cada modelo y un poco de scripting se podrían hacer maravillas. A continuación dejo algunos ejemplos de búsquedas por modelo de router: http:/...