We have discussed about the VoIP penetration testing and security risk and this is the second part of this series article/tutorial, VoIP and wireless security is an important field to discuss because the security risks are very high so below is the demonstration on VoIP hacking with different tools and operating system that has been used for the demonstration was Linux backtrack 5 r2.

Sniffing on VoIP Network

The concept of sniffing in VoIP network is the same as a general
network sniffing concept. I will use some of the most famous tools to
demonstrate the sniffing attack on VoIP network. Let us start with
Wireshark, which is able to capture VoIP traffic.
Now let’s suppose the end users (extensions) are busy
communicating with each other, and that an attacker is trying to
capture some traffic so that he/she will able to get the data (their
communication).

Wireshark has captured some traffic. As discussed above on the
protocol section, RTP contains the information. The question now is:
how do we extract information from these packets? Wireshark provides
the option to extract the information with a built-in feature for
VoIP. Click on the telephony tab – VoIP calls you. You will then
get this window:

Click on the player, then on the decode tab. You are now able to
listen in to this communication and all of the data available in the
audio file.

SIP Authentication Cracking (VoIP Cracking)

The importance of password is not a hidden
truth, so in this section I will show you how to crack the password
of any extension (user) on VoIP network. This attack is the most
dangerous, because if an attacker know your password, then he/she
will be able to authenticate on the network by using your identity.
The Wireshark result can be used for
authentication cracking. Save the result into name.pcap; we will now
use a wonderful tool called SIPcrack. It contains two scripts: one,
sipdump, which will allow you to dump the authentication data into
hashes; the second, sipcrack, which will help you to crack the VoIP
password.

Sipcrack needs a wordlist to launch an
attack. As a result, it will give you the password.

Another wonderful tool that will help you to
crack the SIP password is svcrack. As with the others, it can be find
under the tool suite of sipvicious. Svcrack is wonderful for brute
force attacks on SIP accounts.

Denial of Service Attack on VoIP Network

Denial of server (DOS) attack is a dangerous attack that can cause
the VoIP network and devices to crash. Inviteflood is the tool used
to launch DOS attacks against any extensions (user) on the VoIP
network. Usage:

It seems to be a “ping of death” attack
and it will crash the end user operating system, disabling the
ability of he/she to make any calls.

Iaxflood is another a good tool that can
flood the IAX2 protocol; the usage is very simple:

A simple usage like:

Metasploit on VoIP Penetration Testing

Metasploit has a different auxiliary module
for VoIP network. Here is the list of some best auxiliary modules of
metasploit for VoIP hacking:

• auxiliary/scanner/sip/options
  (To find the SIP enable devices)
• auxiliary/scanner/sip/enumerator (To
  enumerate the extensions)

We can do basic VoIP network penetration
testing by using metasploit auxiliary modules for information
gathering and enumeration. We can scan an entire network to find the
SIP enable devices, plus metasploit auxiliary modules are fast.

VoIP Phishing

Security awareness is very important. Before
concluding this article, I just want to briefly discuss VoIP
phishing. Phishing is not a new attack – it is pretty old school –
but it remains a threat because hackers usually use some social
engineering technique to trick a user before stealing his/her
credential information. You might have heard about email phishing, in
which an attacker directs the victim to a fake page, so that they
will enter their confidential information. In the same fashion, a
hacker can hijack your calls to get your credential information.
Let’s suppose someone received a call or
email like this:

“Hi, this is an urgent email (call) that has been
generated by the network administrator. We have found something wrong
with your account, so please call back at XXXX-XXXX-XXX to verify
your account.” “

Typically, an unwary user will call back;
the hacker may then ask for some confidential information. You need
to understand the risk; educate people around you.