Re: SIP Digest Authentication‏

[Jason Ostrom <justiceguy () pobox com>]

Bassem,

Try sipdump/sipcrack tool.

Jason
On Sep 30, 2011, at 11:02 PM, Bassem Ammar wrote:

> HI,
>
> How can i got the SIP password if i have the following 
>
> 1- SIP USER which use in Digest Authorization 
> 2- realm name
> 3- nonce 
> 4- uri
> 5- response
> 6-cnonce
> 7- REGISTERED captured messages 
>
> As i know this should be 
>
> {HA1} ={MD5}{A1}={MD5}{username}{realm}{password} 
> {HA2} ={MD5}{A2}={MD5}{method}:{digestURI}
> response=MD5{HA1}{nonce}{HA2}
>
> but
> i can't find any free script or tool to get it and am working on , so 
> is there any ideas how to break the SIP digest information leakage and 
> the appropriate tool for this except immunity canvas ?                                          
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
> and CEPT certs require a full practical examination in order to become certified. 
>
> http://www.iacertification.org
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------