Penetration Testing mailing list archives
Voip security
From: "Mike Klingler" <whitehatguru () gmail com>
Date: Sat, 25 Nov 2006 18:27:28 -0600
Working on a recent pen test I ran across a system which was a Cisco Voip gateway allowing SIP and H.323 protocols externally. Only those two ports were available. 1) I fired up Sivus to scan the SIP protocol and found that it allowed unauthenticated invite messages into the server. I follow this up with further research utilizing netcat to receive messages. After the initial "200 trying" response I received a couple of "403 forbidden" responses. My understanding is that the 200 trying meant that the gateway passed the message back to the back end server and that server gave the forbidden. Yet Sivus flagged the vulnerability as High. Am I right in assuming if I knew more about the layout I could try such attacks as a denial of service by ringing all of their phones at the same time, or sending SPIT? What potential flaws could come from this? 2) They also had the H.323 protocol available, but SiVUS doesn't support scanning of that protocol yet. Anyone know of tools, methodologies to test this protocol? Thanks Guys, Mike Klingler ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Voip security Mike Klingler (Nov 25)
- <Possible follow-ups>
- Fw: Voip security Sony C (Nov 26)
- Re: Voip security Marco Ivaldi (Nov 27)