Awesome Real-time Communications Security / Newsletters |
| RTCSec Newsletter | | | |
Awesome Real-time Communications Security / Presentation Slides |
| Hacking VoIP Exposed | | | from Black Hat USA 2006 |
| Mobile network hacking – All-over-IP edition | | | from SRLabs at Blackhat EU 2019 |
| Monitoring SIP Traffic Using Support Vector Machines | | | |
Awesome Real-time Communications Security / Videos |
| OpenSSL DoS (CVE-2022-0778) versus WebRTC infrastructure | | | |
| TAD Summit EMEA Americas 2020: Getting offensive: a different approach to RTC security - Sandro Gauci | | | |
| HITBHaxpo D1: VoLTE Phreaking - Ralph Moonen | | | |
| Kamailio World 2019: The Various Ways Your RTC May Be Crushed - Sandro Gauci | | | |
| Kamailio World 2018: A tale of two RTC fuzzing approaches - Sandro Gauci | | | |
| Kamailio World 2017: Listening By Speaking - Security Attacks On Media Servers And RTP Relays - Sandro Gauci | | | |
| Kamailio World 2016: 9 Years Of Friendly Scanning And Vicious SIP - Sandro Gauci | | | |
| Kamailio World 2015: VoIP Security – Bluebox ng Continuous Pentesting - Sergio García Ramos | | | |
| Kamailio World 2013: VoIP Security Tools - Anton Roman | | | |
| Blackhat EU 2019: Mobile network hacking - All-over-IP edition - Karsten Nohl, Luca Melette & Sina Yazdanmehr | | | |
| Jailbreak Brewing Company Security Summit: Whatsup with WhatsApp: A Detailed Walk Through of Reverse Engineering CVE-2019-3568 - Maddie Stone | | | |
| RhurSec 2016: Eavesdropping on WebRTC Communication - Martin Johns | | | |
| Hak5 1813: SSL Hack Workarounds and WebRTC Flaws | | | |
| media.ccc.de: WebRTC Security - Stephan Thamm | | | (language: german) |
Awesome Real-time Communications Security / Advisories |
| Cisco IOS and IOS XE SIP Protocol Denial of Service Vulnerability | | | |
| Cisco IOS XE Software NAT SIP Application Layer Gateway Denial of Service Vulnerability | | | |
| Cisco TelePresence Video Communication Server SIP DoS Vulnerability | | | |
| Voice over LTE implementations contain multiple vulnerabilities | | | |
| Asterisk RTP Bleed | 38 | about 2 years ago | |
| Asterisk pjSIP CSeq Overflow | 38 | about 2 years ago | |
| Juniper Junos Router OS DoS | | | |
| Remote Access VPN and SIP Vulnerabilities in Cisco PIX and Cisco ASA | | | |
| Interaction SIP Proxy Buffer Overflow in SIPParser() Leads to DoS | | | |
| Asterisk pjSIP Multi Parser Out-of-Bound Memory Access | 38 | about 2 years ago | |
| Asterisk Skinny Memory Exhaustion | 38 | about 2 years ago | |
| Asterisk Stack Corruption in subscribe Message | 38 | about 2 years ago | |
| Asterisk Segfault with Invalid SDP fmtp Attribute | 38 | about 2 years ago | |
| Asterisk Segfault with Invalid Media Format Descriptiom | 38 | about 2 years ago | |
| Asterisk Segfault with INVITE Replay Attack | 38 | about 2 years ago | |
| Kamalio Off-By-One Heap Overflow | 38 | about 2 years ago | |
| New RCS technology exposes most mobile users to hacking | | | |
| Zoom Communications user enumeration | | | |
|
| SIPVicious OSS | 903 | almost 2 years ago | A set of tools to audit SIP based systems |
| SIPPTS | 449 | almost 2 years ago | Another set of tools to audit VoIP servers and devices using SIP protocol |
| bluebox-ng | 263 | over 9 years ago | Pentesting framework using Node.js powers, focused in VoIP. (public archive) |
| SigPloit | 103 | almost 7 years ago | Tool which covers all used SS7, GTP (3G), Diameter (4G) or even SIP protocols for IMS and VoLTE infrastructures |
| vsaudit | 108 | over 8 years ago | VoIP security assessment framework |
| rtpnatscan | 24 | about 9 years ago | Tool which tests for vulnerability |
| VIPROY | 405 | over 4 years ago | VoIP pentest framework which can be used with the metasploit-framework |
| SIP Proxy | | | A VoIP security testing tool |
| Metasploit auxiliary modules | 34,393 | almost 2 years ago | |
| SIPp | | | : SIP based test tool / traffic generator |
|
| SIPp digest leak scenario | | | |
|
| Mr.SIP | 394 | over 3 years ago | SIP based audit and attack tool |
| VoIPShark | 79 | over 6 years ago | Open Source VoIP Analysis Platform |
| Turner | 176 | over 2 years ago | PoC for tunnelling HTTP over a permissive/open TURN server |
| sipsak | 142 | almost 3 years ago | SIP swiss army knife, has some features that can be used for security testing (e.g. flood more or random mode) |
| turnproxy | 27 | over 6 years ago | Tool to abuse open TURN relays |
| SeeYouCM Thief | 184 | over 3 years ago | download and parse configuration files from Cisco phone systems searching for SSH credentials |
| stunner | 771 | almost 2 years ago | a tool to test and exploit STUN, TURN and TURN over TCP servers |
| VoIP Hopper | 68 | over 2 years ago | a tool to exploit insecure VLANs that are often found in IP Telephony infrastructure |
Awesome Real-time Communications Security / Papers |
| Abusing SIP Authentication | | | |
| Multiple Design Patterns for Voice over IP (VoIP) Security | | | |
| Realtime Steganography with RTP | | | ( ) |
| A Lossless Steganography Technique for G.711 Telephony Speech | | | |
| CallRank: Combating SPIT Using Call Duration, SocialNetworks and Global Reputation | | | |
| Steganography of VoIP streams | | | |
| Steganalysis of compressed speech to detect covert VoIP channels | | | |
| Securing Voice over Internet Protocol | | | |
| Protecting SIP Proxy Servers from Ringing-based Denial-of-Service Attacks | | | |
| An ontology description for SIP security flaws | | | |
| Analysis of DDoS Attacks in Heterogeneous VoIP Networks: A Survey | | | |
| Network security systems to counter SIP-based denial-of-service attacks | | | |
| Multilayer Secured SIP Based VoIP Architecture | | | |
| Battling Against DDoS in SIP | | | |
| Billing Attacks on SIP-Based VoIP Systems | | | |
| Secure SIP: A Scalable Prevention Mechanism for DoS Attacks on SIP Based VoIP Systems | | | |
| An Analysis of Security Threats and Tools in SIP-Based VoIP Systems | | | |
| Fast Detection of Denial-of-ServiceAttacks on IP Telephony | | | |
| VoIP Security: Threat Analysis & Countermeasures | | | ( ) |
| Voice Over IP - Security and SPIT | | | |
Awesome Real-time Communications Security / Blogs |
| Enable Security Blog | | | A blog about VoIP, WebRTC and real-time communications security by Enable Security |
| Pepelux blog | | | (Spanish) |
| Kwancro - Thoughts, tips and tricks | | | Often covers SIP honeypot activity and related security topics |
| Fred Posner's Blog | | | includes commentary on VoIP security topics |
Awesome Real-time Communications Security / Notable blog posts and articles |
| Understanding DTLS Usage in VoIP Communications | | | |
| How we abused Slack's TURN servers to gain access to internal services | | | |
| Analyzing WhatsApp Calls with Wireshark, radare2 and Frida | | | |
| Adventures in Video Conferencing Part 1: The Wild World of WebRTC | | | |
| Adventures in Video Conferencing Part 2: Fun with FaceTime | | | |
| Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp | | | |
| Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp | | | |
| Adventures in Video Conferencing Part 5: Where Do We Go from Here? | | | |
| Exploiting CVE-2022-0778, a bug in OpenSSL vis-à-vis WebRTC platforms | | | |
| Analyzing two FreeSWITCH vulnerabilities – CVE-2021-41157 & CVE-2021-37624 | | | |
| Abusing Microsoft Teams Direct Routing | | | |
| Kamailio’s exec module considered harmful | | | |
Awesome Real-time Communications Security / Books |
| Hacking Exposed Unified Communications & VoIP Security Secrets & Solutions, Second Edition 2nd Edition | | | (published December 20, 2013) |
| Hacking VoIP: Protocols, Attacks, and Countermeasures | | | (published March 21, 2008) |
| SIP Security | | | (published April 27, 2009) |
Awesome Real-time Communications Security / Vulnerabilities |
| RTP bleed | | | |
| SIP Digest Leak | | | |
Awesome Real-time Communications Security / CTFs and Learning Resources |
| SIPVicious PRO demo server | | | Live environment for testing RTC attacks |
| CSAW CTF Qualification Round 2020 / Tasks / WebRTC | | | CTF challenge featuring WebRTC (2020) |
|
| Awesome Cellular Hacking | 2,954 | almost 2 years ago | |
| Awesome RTC | 370 | over 4 years ago | |
| Awesome Telco | 712 | almost 2 years ago | |
awesome-rtc-hacking
hack-with-github/awesome-hacking
rtckit/awesome-rtc
miconda/sip-resources
herlesupreeth/docker_open5gs
cellularprivacy/android-imsi-catcher-detector
paullouisageneau/libdatachannel
sepfy/libpeer
ambianic/peerjs-python
p1sec/qcsuper
gortc/stun
fonoster/fonoster
socketio/socket.io-p2p
covertness/coap-rs
sipcapture/homer