Tags › Sip Security

SIPVicious tutorial: testing VoIP security with DVRTC

A hands-on tutorial showing how to use SIPVicious OSS to scan, enumerate, and crack SIP credentials on our DVRTC vulnerable lab at pbx1.dvrtc.net. This is an updated version of our 2020 tutorial that used the now-retired demo.sipvicious.pro server.…

Introducing DVRTC: a vulnerable lab for RTC security

We’re releasing DVRTC (Damn Vulnerable Real-Time Communications), an intentionally vulnerable VoIP/WebRTC lab environment for security training and research. It comes with 7 hands-on exercises covering 12 attack paths, a live deployment at pbx1.dvrtc.net, and everything you need to start practicing RTC security testing.…

VoIP Eavesdropping: How it Works, Threats & Defense Tactics

VoIP eavesdropping is a critical security threat that can expose sensitive business and personal information. This comprehensive guide explains how attackers exploit VoIP vulnerabilities through packet sniffing, MITM attacks, and RTP Bleed, and provides actionable defense tactics including transport encryption, authentication, security audits, and network segmentation to protect your organization.…

Rtpengine RTP Injection and Media Bleed Vulnerabilities (CVE-2025-53399)

We published a critical security advisory for rtpengine affecting versions mr13.3.1.4 and lower, allowing RTP injection and media redirection attacks. These vulnerabilities can be exploited without man-in-the-middle positioning and affect both plaintext RTP and encrypted SRTP sessions. Organizations should upgrade to mr13.4.1.1 and review configuration settings.…

OpenSIPS Security Audit Report is fully disclosed and out there

It’s almost a year since the OpenSIPS project published a minimized version of our security audit report from 2022. Now, the full version has been published, with all the information intact on how to reproduce the vulnerabilities and extra details in an 80+ page report.

The OpenSIPS security audit report can be found here.

What is the OpenSIPS security audit?

OpenSIPS is a SIP server that often has a critical security function within an IP communications system. Thus, it makes absolute sense to perform a thorough security audit for such software. We had been dealing with OpenSIPS servers from time to time in our work so we were rather familiar with the software and the project itself. Then back in January 2021, the lead developer for OpenSIPS, Bogdan-Andrei Iancu, asked us if we would be interested in doing some proper security work. Naturally, our answer was yes please!

SIPVicious PRO incremental update - and Gitlab CI/CD examples

We just pushed out a new SIPVicious PRO update to our subscribing members! This version does not include any new major features. Instead, it fixes various bugs and brings missing but necessary features to various SIPVicious PRO tools. We have the following highlights in this update:

• Documentation now includes realistic Gitlab CI/CD examples
• The RTP fuzzer in the experimental version now supports SRTP
• Support for new SIP DoS flood request methods
• The RTP inject tool can now specify the RTP’s SSRC and payload ID
• The SIP password cracking tool now supports closing the connection upon each attempt
• The SIP ping utility supports INVITE

For the boring details, including a list of bug fixes, do read the release notes for v6.0.0-experimental.6 and v6.0.0-beta.6.

SIPVicious PRO experimental now supports STIR/SHAKEN and 5 new tools

At the time of writing, we maintained two SIPVicious PRO builds for internal use: a stable build and an experimental build. The v6.0.0-beta.5 stable build includes a large number of fixes, much better (or sane) defaults and full coverage of SRTP throughout the toolset.

The experimental version is where the excitement is. Our members now have access to 5 new tools that we find useful in our work:

• RTP fuzzer
• SIP STIR/SHAKEN fuzzer
• SIP Iterator utility
• TCP flood tool
• SIP server for fuzzing

Each new tool warrants a blog post of its own. But that’s not all, because some of the existent tools have now been blessed with STIR/SHAKEN capabilities and also the ability to use multiple source IP addresses for the SIP flood DoS tool.

Abusing SIP for Cross-Site Scripting? Most definitely!

SIP can be used as an attack vector for cross-site scripting (XSS), potentially leading to unauthenticated remote compromise of critical systems. This writeup explores how persistent backdoor administrative access was obtained by sending malicious SIP messages to VoIPmonitor GUI.…

SIPVicious OSS v0.3.4 released with exit codes and automation features

We just made SIPVicious OSS v0.3.4 available, so go get it! Or install it via pip:

pip install sipvicious --upgrade

What’s new?

Two main things:

• Exit codes, just like SIPVicious PRO’s
• Integration with Github Actions

This release makes it much easier to use SIPVicious OSS within your CI/CD pipelines and other automation systems. One should, of course, read the documentation on automation for more information. But here’s an example script to get the idea of what can be done:

DEMO - An overview of the VoIP and RTC offensive security toolset, SIPVicious PRO

We pushed out a video that introduces the basics of SIPVicious PRO by demonstrating some of the attack tools and showing the building blocks for automating security testing of VoIP and WebRTC applications and infrastructure.

What follows is a transcript of the video.

Introduction

Hello, I’m Sandro Gauci from Enable Security. In this video, I’d like to show you what we have been working on, SIPVicious PRO! Let’s start by introducing the tools. SIPVicious PRO is a command-line toolset, meant to test the security of realtime communications, which includes Voice over IP as well as WebRTC infrastructure.