Offensive Security: Pentesting Office Phones with SIPVicious

What it is

A hands-on walkthrough of SIPVicious against an Asterisk PBX, using the specific CLI commands for each phase of a SIP pentest: install, service fingerprinting, extension enumeration, and password cracking.

How it works

Install is via pip in a venv:

python3 -m venv sipvicious
source sipvicious/bin/activate
pip3 install sipvicious

Fingerprinting with sipvicious_svmap 127.0.0.1 (optionally with -e 1000 to pass an extension, since results can vary) reveals the SIP service/version — enough on its own to flag known exploits. Extension enumeration uses sipvicious_svwar 127.0.0.1 -e 1000-1010, with a --force flag worth trying when the server stonewalls (expect a 401 on patched systems, but behavior varies by software). Cracking (sipvicious_svcrack) has three modes: a custom wordlist (-d sip-pass.txt), the tool's built-in default numeric range 100–999 (just -u 1000, no wordlist), and --enabledefaults which adds common passwords plus the extension number itself as a guess.

Preconditions / Affected

Extensions conventionally start at 1000. Enumeration via svwar only works against older/outdated Asterisk or SIP software — the author states modern software ignores enumeration requests outright, so svwar's value depends on the target's software age. Password cracking succeeds when credentials are weak/predictable; in the author's lab, a custom wordlist cracked 3 of 3 test accounts, while the built-in default range and --enabledefaults both failed against one account because its password wasn't predictable.

What to do

sipvicious_svmap 127.0.0.1
sipvicious_svmap 127.0.0.1 -e 1000
sipvicious_svwar 127.0.0.1 -e 1000-1010
sipvicious_svwar 127.0.0.1 -e 1000-1010 --force
sipvicious_svcrack 127.0.0.1 -u 1000 -d sip-pass.txt
sipvicious_svcrack 127.0.0.1 -u 1000
sipvicious_svcrack 127.0.0.1 -u 1000 --enabledefaults

Defensively: upgrade SIP/PBX software regularly (version alone can be enough to compromise a server per the author), since outdated builds are what makes enumeration and default-credential attacks viable.

Caveats

The --enabledefaults and default-range attacks failed in the author's own test run against a non-predictable password — these are not guaranteed wins, only one layer of a broader credential-attack strategy. The page doesn't cover svreport or svcrash beyond naming them as "not really important" for this test.