Re: Sipflanker finds fulnerable Web GUIs deployed by IP phones and PBXs

[mOses <trklisted () networksamurai org>]

You need to look at the overall characteristics of what makes a SIP  
phone work.

TCP/UDP 5060 for SIP
TCP/DUP 5061 for SIP TLS/SSL

Now what would be really nice is a DNS kind of thing where you could  
look for SRV records of

_SIP, _SIPS, SIP.domain.com, etc to locate the SIP server :D

M
On May 28, 2008, at 6:52 PM, Sergio Castro wrote:

> Hi Jason,
>
> Thank you for your comments, I appreciate it.
> Indeed you are right, SIP runs on UDP on 5060. The TCP socket  
> connection
> only tests if the port responds. Do you think it would be better to  
> use UDP?
>
> I did think about adding 5061, but given the unfortunate fact that  
> TLS is
> hardly ever used, and also to make the scan faster, I left it out  
> for the
> time being. But I will add it in future versions.
>
> Thanks! :)
>
> Regards,
>
> Sergio
>
> -----Mensaje original-----
> De: Jason Ross [mailto:algorythm () gmail com]
> Enviado el: Miércoles, 28 de Mayo de 2008 04:58 p.m.
> Para: Sergio Castro
> CC: pen-test () securityfocus com
> Asunto: Re: Sipflanker finds fulnerable Web GUIs deployed by IP  
> phones and
> PBXs
>
> On Tue, May 27, 2008 at 4:00 PM,
> Sergio Castro <sergio.castro () unicin net> wrote:
>
> > What the application does is search the range of IPs you specify, and
> > checks if port 5060 is available. Whether open or close, port usually
> > 5060 indicates the presence of a SIP device.
> > Then it checks if port 80 (http) is open.
>
> Looking through the code, it's a very decent start, and a good idea  
> IMO.
>
> One thing you may want to consider is that SIP generally runs on UDP/ 
> 5060.
>
> Your portscan.py script calls both port 80 and 5060 with AF_INET and
> SOCK_STREAM which would mean TCP both times.
>
> It may make sense to break the SIP scan out such that it checks for  
> both UDP
> and TCP port 5060 (and you may also want to add TCP/5061 to the mix,  
> as
> SIP/TLS generally uses that port.)
>
> Other than that, like I said, a decent bit of work I think.
>
> Regards,
> Jason
>
> __________ NOD32 3142 (20080528) Information __________
>
> This message was checked by NOD32 antivirus system.
> http://www.eset.com
>
>
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Top 5 Common Mistakes
> in Securing Web Applications
> Find out now! Get Webinar Recording and PPT Slides
>
> www.cenzic.com/landing/securityfocus/hackinar
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------