Wednesday 8 October 2008 - 479 read - ( Keywords : Fuzzers , VoIP , VoIPER )
VoIPER is a security toolkit that aims to allow developers and security researchers to easily, extensively and automatically test VoIP devices for security vulnerabilties. It incorporates a fuzzing suite built on the Sulley fuzzing framework, a SIP torturer tool based on RFC 4475 and a variety of auxilliary modules to assist in crash detection and debuggingThe primary goal of VoIPER is to create a toolkit with all required testing functionality built in and to minimise the amount of effort an auditor has to put into testing the security of a VoIP code base. This version has been extensively tested against a variety of SIP clients but should also work versus registrars, proxies, gateways and so on.
For the moment the fuzzer incorporates tests for
SIP INVITE (3 different test suites)
SIP ACK
SIP CANCEL
SIP request structure
SDP over SIP
This translates to well over 200,000 generated tests covering all SIP attributes specified in RFC 3261 for the given messages.
It includes other features such as
Protocol and process based crash detection and recording
Fuzzer pause/restart functionality (SFF)
Supports clients that require registration prior to fuzzing
Simple to expand to new protocols
As far as possible, protocol compliance e.g ACKs and CANCELs responses to prevent some clients hanging
Target process control (SFF)
POSTSCRIPTUM
RELATED ARTICLES
Fuzzers,
VoIP,
VoIPER,
8 October 2008 : VoIPER v0.07 released
25 June 2008 : VoIPER version 0.06 released
3 June 2008 : VoIPER VoIP Exploit Research toolkit updated to 0.0.5
23 April 2008 : VoIPER VoIP Exploit Research toolkit 0.04 released
Security Dashboard
Security vDNA







