Home page logo
/

pen-test logo Penetration Testing mailing list archives

Fw: Voip security
From: Sony C <raagamuffin () yahoo com>
Date: Sun, 26 Nov 2006 06:46:39 -0800 (PST)

Hello Mike,



We are glad to see that Sivus is being used for your VoIP scanning. 

Sivus is currently being updated with a new engine for better multithreading, linux support, new test cases and a host 
of other features including a new interface.

 H.323 has been planned for late next year. 

We intend to add Skinny and MGCP as well.

If you have any specific requests for features please let us know.



Regards,

Sony C. (for the Sivus Development Team).

 



----- Original Message ----

From: Mike Klingler <whitehatguru () gmail com>

To: pen-test () securityfocus com

Sent: Saturday, November 25, 2006 7:27:28  PM

Subject: Voip security



Working on a recent pen test I ran across a system which was a Cisco

Voip gateway allowing SIP and H.323 protocols externally.  Only those

two ports were available.



1)  I fired up Sivus to scan the SIP protocol and found that it

allowed unauthenticated invite messages into the server.  I follow

this up with further research utilizing netcat to receive messages.

After the initial "200 trying" response I received a couple of "403

forbidden" responses.  My understanding is that the 200 trying meant

that the gateway passed the message back to the back end server and

that server gave the forbidden.  Yet Sivus flagged the vulnerability

as High.  Am I right in assuming if I knew more about the layout I

could try such attacks as a denial of service by ringing all of their

phones at the same time, or sending SPIT?  What potential  flaws could

come from this?



2)  They also had the H.323 protocol available, but SiVUS doesn't

support scanning of that protocol yet.  Anyone know of tools,

methodologies to test this protocol?



Thanks Guys,

Mike Klingler




















__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]