IP telephony penetration testing methodology

Performing penetration testing on VoIP streaming and media protocols follows a bit of a different approach than the penetration testing methodology that we follow for other technologies, such as the web or networks. The following are the steps performed in IP telephony network penetration testing that we perform to identify potential threats:

1. Enumeration – In simple terms, this is defined as gathering the right information that is required to identify potential threats. The following information is required to begin with the exploitation phase:
   1. Identify the IP telephony SIP servers.
   2. Identify the potential targets.
   3. Identify the vulnerable services on the identified targets.
   4. Run NMAP SIP scripts.
   5. Run vulnerability scanning.
2. SIP penetration testing – Once all the data is successfully gathered, the following attacks will be performed on the potential targets:
   1. Brute-force – SIP server credentials
   2. Brute-force SIP authentication...