WireBug
WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program.
Installation
Read the Installation Guide in the wiki.
Tools
-
FullBridge: This is a simple bash script to set up a layer2 bridge with two defined interfaces.
-
TimeShift: Tool for response to a NTP request in a man-in-the-middle position (also with FullBridge) with a timestamp in the past or future. You can easily check if the client (VoIP Phone) checks the validity of the server certificate (SIPS, H.323s, HTTPS, LDAPS etc.), or simply use it as a DOS Tool.
-
VlanEnum: This bash script creates 802.1Q virtual interfaces with VLAN tagging and waiting for possible DHCP responses. If it was possible to get an IP Address the interface will be staid alive otherwise it will be deleted.
-
SaCLaC: This includes two python programs. One for spoofing fake LLDP-MED packets to getting into VoIP VLAN or trigger a DoS by instruct the client to set a VLAN-Tag and one to analyze CDP Information of a PCAP File.
-
DecryptSRTP: This script makes it easy to use the Cisco Systems' SRTP library for decrypting a SRTP-SDES Stream if the AES-Key was extracted from the signalling part.
-
CrackTheSIP: A simple brute force tool for cracking SIP digest authentication by using a word list.
-
ZRTPDowngrade: A Tool to drop ZRTP initiated Packets in a man-in-the-middle position.
-
EvilSTUN: A simple tool for fake STUN responses.
-
SIPFuzz: A tool for SIP fuzzing.
-
SIPEnum: This tool enumerates SIP extensions by a given file.
-
SIPBrute: A tool for online brute force attacks against SIP proxies.
-
SIPDiscover: A tool to discover SIP services.
-
RTPFuzz: A tool for fuzzing an injecting random RTP packets (noise) into running streams.
-
RTPAudioInjection: A tool for injecting a raw audio file into running streams.
Usage
Read the wiki pages for more information.
Wizard
The goal of the WireBug tool set is the wizard with tab-completion. This makes it easy to use without knowledge of detailed information about the tool or options. Additionally, you can use any tool from the command line.
Start the Wizard
python wirebug.py
Output
__ __.__ __________
/ \ / \__|______ ____\______ \__ __ ____
\ \/\/ / \_ __ \_/ __ \| | _/ | \/ ___\
>>>>>\>>>>>>>>/|>>||>>|>\/\>>>>>/|>>>>|>>>\>>|>>/>/>/>>>>>>>
\__/\ / |__||__| \___ .______ /____/\___ /
\/ \/ \/ /_____/
by Moritz Abrell - SySS GmbH, 2019 - 2021
Follow the wizard to use WireBug.
Use TAB to show possible options.
wizard > help function
wizard > help
Documented commands (type help <topic>):
========================================
bridge evilstun lldpspoof sipcrack timeshift
cdpanalyze exit rtpaudioinject sipdiscover vlanenum
clear help rtpfuzz sipenum zrtpdowngrade
decryptsrtp lldpdos sipbrute sipfuzz
Sample Usage Video
References
Author
Moritz Abrell, SySS GmbH 2019-2021
Disclaimer
Use at your own risk. Do not use without full consent of everyone involved. For educational purposes only.