List of Figures

Chapter 1: Footprinting a VoIP Network

Figure 1-1: The VoIP security pyramid sliced open
Figure 1-2: A few names to get started
Figure 1-3: Use Microsofts TerraServer ( to locate your target, in this case the Spy Museum in Washington DC.
Figure 1-4: Google Local ( can help locate targets in any town.
Figure 1-5: Here a hacker can figure out where your online voicemail system is installed.
Figure 1-6: A brief overview of Harvard's VoIP offering
Figure 1-7: SecurityFocus catalogs a good collection of vulnerabilities for a variety of products, including the Cisco IP Phone 7960.
Figure 1-8: The network settings for a phone exposed to the Internet, including IP addresses for TFTP servers, the CallManager server, and the router
Figure 1-9: A graphical structure of the Tulane DNS and SMTP servers
Figure 1-10: Some interesting DNS names are attached to this IP address space.

Chapter 2: Scanning a VoIP Network

Figure 2-1: SIP environment network map
Figure 2-2: SuperScan from Foundstone quickly returns our ping sweep results.
Figure 2-3: SolarWinds Ping Sweep tool
Figure 2-4: SuperScan host probing other ICMP options
Figure 2-5: MAC Address Discovery tool from SolarWinds
Figure 2-6: SNMP scanning using SNScan within an organization

Chapter 3: Enumerating a VoIP Network

Figure 3-1: SiVuS helps us find the same information we found manually with the click of a button.
Figure 3-2: The Retina scanner against the Polycom phone
Figure 3-3: The Saint scanner in action against the Polycom phone
Figure 3-4: Selecting the specific Nessus scanning modules to run against the phone
Figure 3-5: Selecting the VoIP exploit plugins to launch
Figure 3-6: SIPSCAN using REGISTER requests against the Asterisk deployment at
Figure 3-7: Using SIPSCAN against our Cisco IP Phone 7912 to find its extension
Figure 3-8: SNMPSweep shows that the Avaya IP phone and Zultys Zip2 phone both responded to SNMP probes with the "public" community string.
Figure 3-9: SolarWind's MIB browser finding the Avaya OID

Chapter 4: VoIP Network Infrastructure Denial of Service (DoS)

Figure 4-1: Cisco Policy Manager 3.2
Figure 4-2: Wireshark raw packet capture
Figure 4-3: RTP Streams overview
Figure 4-4: Graph of jitter over time
Figure 4-5: Empirix Hammer Call Analyzer
Figure 4-6: WildPackets EtherPeek VoIP analysis

Chapter 5: VoIP Network Eavesdropping

Figure 5-1: Netstumbler shows which networks are using WEP encryption.
Figure 5-2: Ministumbler is a stripped-down version of Netstumbler that runs on PDAs.
Figure 5-3: Beware of the Snom phone packet capture feature!
Figure 5-4: A Metasploit Framework exploit for Windows
Figure 5-5: Wireshark's VoIP call analyzer
Figure 5-6: Wireshark RTP Streams listing
Figure 5-7: Wireshark RTP Stream Analysis
Figure 5-8: Saving the stream as an audio file
Figure 5-9: Cain and Abel
Figure 5-10: Cain and Abel's VoIP reconstruction
Figure 5-11: DTMF Decoder translating the touch tones for 1-2-3-4

Chapter 6: VoIP Interception and Modification

Figure 6-1: Our SIP test bed
Figure 6-2: Cain's MAC Address Scanner
Figure 6-3: List of newly found hosts
Figure 6-4: New ARP Poison Routing window
Figure 6-5: Selecting the ARP poisoning victims
Figure 6-6: All ready to begin the ARP poisoning
Figure 6-7: Packet interception after our phone call
Figure 6-8: Our captured conversation converted to a WAV file
Figure 6-9: Capturing SIP hashes
Figure 6-10: Listing of all passwords we can try to crack
Figure 6-11: Cracking the phone's password through a brute-force attack
Figure 6-12: ettercap setup
Figure 6-13: ettercap is now ready to start scanning for hosts.
Figure 6-14: Our targets are now selected.
Figure 6-15: Our active VoIP connection
Figure 6-16: Dialog box showing a possible man-in-the-middle attack as it's occurring
Figure 6-17: Rogue SIP B2BUA
Figure 6-18: Rogue SIP proxy
Figure 6-19: SIP test bed
Figure 6-20: Using a rogue SIP B2BUA to tap a call

Chapter 7: Cisco Unified CallManager

Figure 7-1: The SCCP call setup
Figure 7-2: The media setup
Figure 7-3: The session teardown
Figure 7-4: Loading the traffic capture of Skinny communications in Wireshark
Figure 7-5: Single site Cisco VoIP deployment
Figure 7-6: Centralized multisite VoIP deployment
Figure 7-7: Finding the phones in order to disable the web browser
Figure 7-8: CDP dump in Wireshark of a Cisco SIP 7960 phone
Figure 7-9: SNMP browsing of a Cisco CallManager
Figure 7-10: SNMP Service Properties window editing the Public string
Figure 7-11: Metasploit Framework with the infamous LSASS vulnerability
Figure 7-12: Cisco Voice Technology Group Subscription Tool
Figure 7-13: Cisco Product Alert Tool
Figure 7-14: Disabling features on a Cisco hard phone

Chapter 8: Avaya Communication Manager

Figure 8-1: Avaya media servers
Figure 8-2: Avaya media gateways
Figure 8-3: Avaya systems and number of supported stations
Figure 8-4: Selected Avaya IP phones
Figure 8-5: Avaya Standard Management Solution main screen
Figure 8-6: Example System Access Terminal (SAT) screen
Figure 8-7: Management systems and systems using APIs
Figure 8-8: Small site configuration
Figure 8-9: Large site configuration containing several small sites
Figure 8-10: Avaya test bed
Figure 8-11: IP phone signaling and audio ports
Figure 8-12: IP phone initialization and address resolution ports
Figure 8-13: IP phone application resolution ports
Figure 8-14: Service Access control screen
Figure 8-15: Firewall control screen

Chapter 9: Asterisk

Figure 9-1: Asterisk as a PBX gateway
Figure 9-2: Asterisk test configuration

Chapter 10: Emerging Softphone Technologies

Figure 10-1: Making a call with Skype
Figure 10-2: SkypeKiller lets you uninstall Skype.
Figure 10-3: Making a call with Gizmo
Figure 10-4: Setting preferences in Gizmo
Figure 10-5: VoIP and Google Talk
Figure 10-6: VoIP and AOL Triton
Figure 10-7: VoIP and Windows Live Messenger
Figure 10-8: VoIP and Yahoo Messenger with Voice
Figure 10-9: A traditional click-to-call dialog box

Chapter 11: VoIP Fuzzing

Figure 11-1: TCPView running on the softphone host
Figure 11-2: The Pingtel SIP Softphone
Figure 11-3: The Pingtel crash error message
Figure 11-4: The Codenomicon SIP test tool

Chapter 12: Flood-based Disruption of Service

Figure 12-1: Flood-based disruption of service
Figure 12-2: SIP test bed
Figure 12-3: Basic setup for fl ood-based attacks
Figure 12-4: SIP phone with over 12,000 missed calls
Figure 12-5: Targeting a SIP proxy with a nonexistent SIP phone
Figure 12-6: Targeting a SIP proxy with an invalid IP domain address
Figure 12-7: Targeting a SIP proxy with an invalid domain name
Figure 12-8: Targeting a SIP proxy with an invalid SIP phone in another domain
Figure 12-9: Targeting a SIP proxy with a valid SIP phone in another domain
Figure 12-10: Targeting a SIP proxy for a valid SIP phone
Figure 12-11: Targeting a SIP proxy when authentication is enabled
Figure 12-12: Using SiVuS to target a SIP proxy with an invalid SIP phone
Figure 12-13: Using SiVuS to target a SIP proxy with a valid SIP phone
Figure 12-14: Targeting SIP phones with INVITE fl oods using SiVuS
Figure 12-15: Operating a media gateway in a SIP network

Chapter 13: Signaling and Media Manipulation

Figure 13-1: Registration removal with SiVuS
Figure 13-2: Registration addition with SiVuS
Figure 13-3: Registration hijacking
Figure 13-4: MITM registration hijacking
Figure 13-5: Registration hijacker attack approach
Figure 13-6: SIP phone reboot with SiVuS
Figure 13-7: RTP insertion/mixing

Chapter 14: SPAM over Internet Telephony (SPIT)

Figure 14-1: SPIT call product examples
Figure 14-2: SPIT test bed

Chapter 15: Voice Phishing

Figure 15-1: A traditional phishing campaign
Figure 15-2: The PayPal voice phishing email
Figure 15-3: Getting an 800 number through a VoIP provider is easy .
Figure 15-4: The Trixbox administrative web console
Figure 15-5: Voice phishing hits the mainstream.

Hacking Exposed VoIP. Voice Over IP Security Secrets & Solutions
Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions
ISBN: 0072263644
EAN: 2147483647
Year: 2004
Pages: 158 © 2008-2017.
If you may any questions please contact us: