{"id":4778,"date":"2017-11-29T00:00:59","date_gmt":"2017-11-28T16:00:59","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4778"},"modified":"2017-11-29T00:01:18","modified_gmt":"2017-11-28T16:01:18","slug":"mr-sip-sip-attack-audit-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2017\/11\/mr-sip-sip-attack-audit-tool\/","title":{"rendered":"Mr.SIP &#8211; SIP Attack And Audit Tool"},"content":{"rendered":"<p>Mr.SIP was developed in Python as a SIP Attack and audit tool which can emulate SIP-based attacks. Originally it was developed to be used in academic work to help developing novel SIP-based DDoS attacks and defence approaches and then as an idea to convert it to a fully functional SIP-based penetration testing tool, it has been redeveloped into the current version.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/Mr.SIP-SIP-Attack-And-Audit-Tool-640x335.png\" alt=\"Mr.SIP - SIP Attack And Audit Tool\" width=\"640\" height=\"335\" class=\"aligncenter size-medium wp-image-4904\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/Mr.SIP-SIP-Attack-And-Audit-Tool-640x335.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/Mr.SIP-SIP-Attack-And-Audit-Tool-1024x536.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/Mr.SIP-SIP-Attack-And-Audit-Tool-1536x805.png 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/11\/Mr.SIP-SIP-Attack-And-Audit-Tool.png 1823w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h2>Mr.SIP &#8211; SIP Attack Features<\/h2>\n<p>Mr.SIP currently comprises of four sub-modules named SIP-NES, SIP-ENUM, SIP-DAS and SIP-ASP. Since it provides a modular structure to developers, more modules will continue to be added by the authors and it is open to being contributed to by the open-source developer community.<\/p>\n<ul>\n<li><strong>SIP-NES<\/strong> needs to enter the IP range or IP subnet information. It sends SIP OPTIONS message to each IP addresses in the subnet and according to the responses outputs the potential SIP clients and servers on that subnet.<\/li>\n<li><strong>SIP-ENUM<\/strong> outputs which SIP users are valid according to the responses in that network by sending REGISTER messages to each client IP addresses on the output of SIP-NES.<\/li>\n<li><strong>SIP-DAS<\/strong> (DoS Attack Simulator) is a module developed to simulate SIP-based DoS attacks. It comprises four components: spoofed IP address generator, SIP message generator, message sender and scenario player. It needs outputs of SIP-NES (Network Scanner) and SIP-ENUM (Enumerator) along with some pre-defined files.<\/li>\n<li><strong>SIP-DAS<\/strong> basically generates legitimate SIP INVITE message and sends it to the target SIP component via TCP or UDP. It has three different options for spoofed IP address generation, i.e., manual, random and by selecting spoofed IP address from subnet. IP addresses could be specified manually or generated randomly. Furthermore, in order to bypass URPF filtering, which is used to block IP addresses that do not belong to the subnet from passing onto the Internet, we designed a spoofed IP address generation module. Spoofed IP generation module calculated the subnet used and randomly generated spoofed IP addresses that appeared to come from within the subnet.<\/li>\n<\/ul>\n<p>There is also:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2008\/09\/ohrwurm-rtp-fuzzing-tool-sip-phones\/\">ohrwurm \u2013 RTP Fuzzing Tool (SIP Phones)<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2008\/08\/sipcrack-sip-login-dumper-hashpassword-cracker\/\">SIPcrack \u2013 SIP Login Dumper &#038; Hash\/Password Cracker<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2008\/06\/sipflanker-locate-sip-voip-device-web-interfaces\/\">Sipflanker \u2013 Locate SIP (VoIP) Device Web Interfaces<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2007\/01\/sip-proxy-voip-security-testing-tool\/\">SIP Proxy \u2013 VoIP Security Testing Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2011\/05\/sipvicious-sip-scanner-voip-hacking-security-auditing-tool\/\">SIPVicious SIP Scanner \u2013 VoIP Hacking Security Auditing Tool<\/a><\/p>\n<p>You can download Mr.SIP here:<\/p>\n<p><a href=\"https:\/\/github.com\/meliht\/Mr.SIP\/archive\/master.zip\">Mr.SIP-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/meliht\/mr.sip\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mr.SIP was developed in Python as a SIP Attack and audit tool which can emulate SIP-based attacks. Originally it was developed to be used in academic work to help developing novel SIP-based DDoS attacks and defence approaches and then as an idea to convert it to a fully functional SIP-based penetration testing tool, it has [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Mr.SIP was developed in Python as a SIP Attack and audit tool which can emulate SIP-based attacks. Originally it was developed to be used in academic work.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[284,2984],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4778"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4778"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4778\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}