Thursday, March 15, 2007

Hacking and Hijacking VoIP



Yup, i know this might been posted before. Still i managed to setup a PBX in linux box and hijack the session. Well, if you ask me, VoIP with TLS encryption is good, but there will be latency and expect to experience slowness when talking to your peer. With this experiment, all you need is siVus from http://www.vopsecurity.org/ x-lite softphone from http://www.xten.com/ and SER from http://www.iptel.org/ser/
You can read more about VoIP from the siVus website, under the papers section.

SCENARIO:

The above pic dictates this scenario.

Registrar: 192.168.1.138
ong: 192.168.1.45 (attacker)
ronald: 192.168.1.20
test: 192.168.1.55


Use sivus message generator to generate a REGISTER request for ronald(182.168.1.20) to the Registar.

In the Register request, the From and To headers must use the same user information.

The fields in Sivus to note for

Method: REGISTER

Domain/Host: 192.168.1.138 Port:5060

To: root

From: root

Branch: To find out which branch, launch the softphone and use Wireshark to sniff UDP packets to find out the branch number.

Contact:

To find out the port number of the softphone used, use a tool like tcpview to see the port number.

Click start


Hijacking a connection from ronald.

Scenario: Under normal circumstances, test(Caller) will call ronald(callee). Ong(Attacker) will then send a register request for ronald using the above fields to hijack the connection for ronald, ultimately ong will be the one speaking to test. Mission accomplished.

12 comments:

Anonymous said...

GxhLvp [url=http://www.bootsshowjp.com/]アグ ブーツ [/url] UcqDhi http://www.bootsshowjp.com/ TckUnu [url=http://www.mutonbu-tsu.com/]アグ ブーツ[/url] GyuMkz http://www.mutonbu-tsu.com/ KyeByf [url=http://www.australiabestboots.com/]アグ[/url] TwtBdp http://www.australiabestboots.com/ PawJkm[url=http://www.bestbootsjapan.com/]ugg メンズ[/url] DjbJzb http://www.bestbootsjapan.com/ KgnSxs [url=http://www.bootshotsales.com/]ugg ムートン[/url] LbpEdy http://www.bootshotsales.com/ LoqHrv [url=http://www.bootssaletojp.com/]アグ[/url] ZrvRzg http://www.bootssaletojp.com/ BvfZjl

Anonymous said...

TvqUje [url=http://www.bu-tsujapan.com/]ugg アグ ブーツ[/url] XjuFyg http://www.bu-tsujapan.com/ CymXap [url=http://www.bu-tsujp.com/]ugg 激安[/url] VytApd http://www.bu-tsujp.com/ NvrIih [url=http://www.newbootstojp.com/]ugg[/url] UtyYnt http://www.newbootstojp.com/ XsaApq [url=http://www.kutsujp.com/]ugg アグ ブーツ[/url] NukJgs http://www.kutsujp.com/ ZekOct [url=http://www.bootsladiesnew.com/]UGG ブーツ[/url] ObfTeu http://www.bootsladiesnew.com/ JlqBza [url=http://www.bu-tsugekiyasu.com/]アグ ブーツ[/url] ZwkOjr http://www.bu-tsugekiyasu.com/ TrtKet

Anonymous said...

Should be truth, medical professional's assistance individuals to possess a a minimum of regarding A handful of fresh fruit bit each and every day to accomplish cheap moncler jackets greatest health and fitness income. On the some other hand, fruit hold low marks related to sodium, received high dietary fiber additionally very eatable furthermore. Which elements form taking that approach perfect for fat loss formulation the way it enhances the actual digestion of food combined with metabolic process value and even forbidding your body flow far healthier received from continuous surplus drinking waters.
moncler for job
Perhaps you could On the website certainly declare, it really gets cold in addition to a colder, stylish Moncler jacket is very rare. And 'drastically wrong! Allure Moncler you already know this is the primary, until a permanent basis. When you've grown variety, Moncler is ideal.
These jackets are also provided in the fur would be the property of the coldest winter. You can get the windbreaker jackets that could be the right mix of both cool and windy this time of your time. Jackets are no doubt a fabulous way to keep you comfortable in moncler outlet winter chilly.

Anonymous said...

Thanks for the excellent post!
I certainly enjoyed reading it, you happen to be a
great writer. Keep up with the good job, have a
nice afternoon!

Here is my blog - Golf Shot Tips : How to Golf Putt

Anonymous said...

I know this if off topic but I'm looking into starting my own weblog and was curious what all is required to get setup? I'm assuming having a blog like yours would cost a pretty penny?
I'm not very internet savvy so I'm not 100% positive. Any suggestions or advice would be greatly appreciated. Many thanks

My blog ... iPad Golf

Anonymous said...

Excellent read! I've updated your RSS feeds to my Google account.

Look into my blog post: get rid of nail fungus how to get rid of toenail fungus

Anonymous said...

Hey there!
Would you mind sharing which blog platform you're working with? I'm going to start my own blog in the near future but I'm having a hard time choosing between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design seems different then most blogs and I'm looking for something
unique.
P.S. Sorry for getting off-topic but I had to ask!


My web page: Gas Mileage

Anonymous said...

Admiring the commitment you put into your blog and in depth information
you offer. It's awesome to come across a blog every once in a while that isn't the same out of date rehashed material.



my blog :: Desktop Gadgets

Anonymous said...

Hey,
On this write up you clarify a bunch of of the most integral opinions!

Straight forward to read & inclusive of very helpful tips.

Thank you for sharing Blogger: Taking Network Security to the Streets.


Feel free to surf to my site Shooting Games
My site - Army Games

Anonymous said...

Wow that was odd. I just wrote an very long comment but after I clicked submit my comment didn't appear. Sucks! Anyways, just wanted to say excellent blog!
My partner and I frequently write guest articles or blog posts for other blog site owners to help gain publicity to our work, as well as provide great content to blog owners. It truly is a win win situation! If you are interested feel free to e-mail me so we can talk further. Thanks!!

Feel free to surf to my site; best free iphone games

Anonymous said...

Hi there!
I really love your article!! Good piece of work on the look of your website.
.
Thank you

Here is my web blog: How to Golf App
my webpage > How to Golf App

Anonymous said...

As ever, so fascinating and also constructive post on Blogger: Taking Network Security to the Streets.
.
Thanks a lot.

Feel free to surf to my blog post; Beginners Golf