search

EnableSecurity / sipvicious

SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
https://www.enablesecurity.com/sipvicious/oss/
Other
896 stars 158 forks source link

Fixed digest auth issue due to target misimplementation (lack of `noncecount`) #83

Closed anio closed 2 years ago

anio commented 2 years ago

Whenever a target server gives a digest authentication challenge, sipvicious will need to respond the challenge. In some implementations, server challenge doesn't contain the noncecount, which leads sipvicious to unexpected behavior.

I'm not sure if this fix is the best solution or not, but it uses a default value (00000001) for the noncecount value when challenge doesn't contain it.

sandrogauci commented 2 years ago

let's have it this way. Another way might be to not threat it as md5-sess or qop=auth but that's even more ambiguous.