Security Audit of NGN and VoIP Systems (Turkish)

I have presented a seminar about NGN and VoIP Security Analysis at Cypsec 2013 event. This slide set includes NGN and VoIP Attacking Techniques in Basic, Using Viproy VoIP Kit for Attacks and Its Features. 

SSL over IO Usage for Converting HTTPS Connect Requests on MITM Analysis

Mobile applications use SSL Connect requests to connect remote server for HTTPS Communications. Mobile Applications should be analyzed dynamically during Penetration Tests and MITM attacks are very useful in this stage. HTTPS communications should be converted via MITM Proxies such as Burp Proxy and Fiddler2. These tools useful to convert HTTPS Connect requests and intercept them. Manual request mangling and fuzzing depend on this HTTPS Connect conversion. These tools are closed source and they don't explain this feature.   

MBFuzzer is a subproject of Yakindan Egitim, I'm mentor of this MBFuzzer and Mehmet Kilic is the developer of it. MBFuzzer is an MITM Mobile Application Fuzzing tool, HTTPS Connect conversion is one of the main requirements. We presented a way to convert HTTPS Connect requests via IO (Input/Output).  It has a little CA Error bug but it works for conversion, it will be fixed later.

When MBFuzzer Proxy detects a HTTPS Connect Request (CONNECT domain:port HTTP/1.1), it connects target (domain:port) and send "HTTP/1.1 200 Connection Established" message to client socket. After this message, Client tries to initiate a HTTPS session and MBFuzzer accepts this connection as a server via sending connection to ssl_io function (ssl_connection=ssl_io(connection)).

This Code is Responsible to Convert HTTPS Requests

#creating ssl io object

def ssl_io(io)

begin

   sslContext = OpenSSL::SSL::SSLContext.new

   sslContext.cert = OpenSSL::X509::Certificate.new(File.open('./certs/server.crt'))

   sslContext.key = OpenSSL::PKey::RSA.new(File.open('./certs/server.key'))

   sslContext.ca_file = './certs/cacert.pem'

   sslContext.verify_mode = OpenSSL::SSL::VERIFY_NONE

sslio = OpenSSL::SSL::SSLSocket.new(io, sslContext)

sslio.sync_close = true

sslio.accept

rescue Exception => sslException

puts "SSL Exception : #{sslException}"

end

return sslio

end

Standard implementations of ruby SSL servers use OpenSSL::SSL::SSLServer class, unfortunately this class is not useful in this situation. It's designed to serve SSL via TCP Socket and it doesn't work without it. We used OpenSSL::SSL::SSLSocket class that designed to initiate SSL client requests. We disabled "sync" that try to make an SSL handshake and started to accept this IO as an SSL socket. After this modifications; MBFuzzer accepts HTTPS Connect requests, handles SSL IO as a server, manipulate content, sends it to remote server and redirect response to client via SSL session.

We have a few bugs of course, a tls error caused by CA issues and IO.sysread problems. You can inspect our project, use this HTTPS Proxy Library in your project or send us fixes. It's license is GPL, you can use or contribute it. We are working on bugs, on-the-fly certification generation and request mangling features. I'll keep this blog updated about MBFuzzer and Yakindan Egitim projects.

Viproy - VoIP Penetration and Exploitation Testing Kit

Viproy Voip Pen-Test Kit is developed to improve quality of SIP Penetration Tests. It provides authentication feature that helps to create simple tests. It includes 7 different modules with authentication support: options tester, brute forcer, enumerator, invite tester, trust analyzer, proxy and registration tester. All attacks could perform before and after authentication to fuzz SIP services and value added services.

Project Page : http://www.github.com/fozavci/viproy-voipkit
Download : https://github.com/fozavci/viproy-voipkit/archive/master.zip


Attacking SIP/VoIP Servers Using VIPROY VoIP Pen-Test Kit for Fun & Profit - Video

This is a training video for penetration testing of SIP servers.

Chapters of Training Video
1-Footprinting of SIP Services
2-Enumerating SIP Services
3-Registering SIP Service with/without Credentials
4-Brute Force Attack for SIP Service
5-Call Initiation with/without Spoof & Credentials
6-Hacking Trust Relationships
7-Intercepting SIP Client with SIP Proxy

Exploit Development Using Metasploit Framework (Presentation)

Me and my friend, Canberk Bolat, have presented a seminar about Exploit Development and Metasploit Framework at Free Software and Linux Days 2013 event. This slide set includes basic Exploit Development Techniques, Metasploit Framework Mixins and Its Features. Also we have demonstrated exploit development techniques with sample codes and exploit modules.

Hacking Trust Relationships of SIP Gateways (Video Demo)

I prepared an on-the-fly video demo for SIP Trust hacking. This video contains a demonstration about my technical paper, hacking trust relationships of SIP gateways. This paper and my "SIP Pen-Testing Kit for Metasploit" available at http://gamasec.net/fozavci/index-en.html. The tool, SIP Trust Analyzer will be available after Athcon 2013. Another Shiny demo will be presented at Athcon 2013, this video means only "it's just working".

MBFuzzer: MITM Fuzzing for Mobile Applications

Yakindan Egitim project is started last week, it's a training project like Google Summer of Code. Homepage is www.yakindanegitim.org, Blog address is blog.yakindanegitim.org and Github address isgithub.com/YakindanEgitim . I'm mentor of MBFuzzer, Mobile Application Fuzzing project, it's a sub-project of Yakindan Egitim.

Here is the presentation for MBFuzzer, MITM Fuzzing for Mobile Applications. I try to explain our project, goals and roadmap in this presentation. Also I explained MITM Fuzzing for Mobile Applications, its benefits, problems of testing and MITM Fuzz techniques. 

Yakindan Egitim: Mobile Application Fuzzer via SSL MITM

Yakindan Egitim project is started last week, it's a training project like Google Summer of Code. Homepage is www.yakindanegitim.org, Blog address is blog.yakindanegitim.org and Github address is github.com/YakindanEgitim . 

I started a sub-project at Yakindan Egitim, Mobile Application Fuzzer via SSL MITM (mbfuzzer). I'm mentor of MBFuzzer and waiting for attendees. Also I'll code it, don't feel that you are alone. You could join the project if you are a student at any university and interested. Please visit our blog for further information.

Mobile Application Fuzzer via SSL MITM (mbfuzzer)

Project Home 

github.com/yakindanegitim/mbfuzzer

Development Platform : Ruby 2.0

MBFuzzer will be developed for MITM (Man in the Middle) Fuzzing. Mobile applications use HTTP, SOAP, XML and JSON based data streams for communicate the servers. Many mobile applications use SSL Connect method for server communication. This method should be converted to HTTPS GET/POST method for MITM attacks. MBFuzzer will provide HTTP/HTTPS Proxy functionality and Real-Time Fuzzing feature with HTTP Connect conversion support

Features

• HTTP/HTTP Proxy Support
• HTTPS Connect Conversion Support
• On-The-Fly Valid SSL certificate generation for target server
• Real-Time Response/Request Fuzzing Support
• Fake Service Installation via XML/JSON Templates
• Supports Different Injection Payloads using Templates

Inspired Projects

Android Proxy - https://code.google.com/p/androidproxy

Project Team Requirements

• Good Understanding of SSL/TLS Technology
• Ruby Development Skills
• JSON & XML Knowledge
• Fuzzing Knowledge

Hacking Trust Relationships Between SIP Gateways

----------------------------------a Good Introduction from Mr. Paul Henry (phenry at sans.org)-----------------

The ability to abuse trust relationships has plagued (and continues to) many aspects of network security. One of the most memorable attacks that clearly illustrated an abuse of trust relationships was back in 1995 - the Kevin Mitnick / Tsutomu Shimomura hack. Through a combination of spoofing his IP address, guessing predictable IP sequence numbers and a SYN flood attack Kevin Mitnick was able to abuse the trust relationship of Tsutomu Shimomura's network. Once he had successfully abused the trust relationship of Tsutomu Shimomura's network he was able to then maintain persistence by simply adding himself to the .rhosts file on Tsutomu Shimomura's computer. While it was 18 years ago the premiss of the attack is still just as relevant today as shown in this blog post - Trust Relationship + Reconnaissance + Predictability = HACKED ! 

----------------------------------------------------Thanks for Introduction---------------------------------------------------

NGN (Next Generation Networks) operators provide SIP services for their customers. Customers can call other operator's customers via SIP services and SIP gateways. SIP gateways use SIP Trunks for trusted call initiation and cdr/invoice management.

SIP trunk defines as an IP address or specific FROM number in many cases. Challenge-Response or certificate based authentication is slow for quick response in this type of large call counts. Because of that, SIP trunks have no password or IP based filter applied for trunk authentication. These SIP trunks use specific FROM numbers or Proxy fields to initiate a call. Besides, most of SIP trunks have Direct INVITE privilege without REGISTER.

SIP/NGN Services Pen-Testing using SIP Pen-Testing Kit (Training Video)

SIP Pen-Testing Kit for Metasploit is developed to help SIP Pen-Tests. This video prepared for demonstration and training for SIP Pen-Testing Kit.

Pen-Testing Steps in the Video

• SIP Service Discovery
• Using OPTIONS Requests
• Using REGISTER Requests
• REGISTER Without Credentials
• REGISTER With Valid Credentials
• Call Tests
• Direct INVITE Without Credentials
• INVITE With Credentials
• INVITE Spoofing With Credentials
• DOS Tests
• INVITE Sending to Valid Users (With/Without Credentials)
• INVITE Sending to Numeric Range (With/Without Credentials)
• Enumeration
• Enumerating Users and Accounts with Numeric Range (SUBSCRIBE, REGISTER, INVITE)
• Enumerating Users and Accounts with a Users File (SUBSCRIBE, REGISTER, INVITE)
• Brute Force
• Password Brute Force to a Target Account
• Password Brute Force to a Numeric Range
• Password Brute Force with a Users File

For Code
http://www.github.com/fozavci/gamasec-sipmodules

GamaSEC SIP Pen-Test Kit for Metasploit Framework

Project Page : http://www.github.com/fozavci/gamasec-sipmodules

SIP library for Metasploit is developed to help SIP Penetration Tests. It provides authentication feature that helps to create simple tests. It includes 5 different modules with authentication support: options tester, brute forcer, enumerator, invite tester and registration tester. All attacks could perform before and after authentication to fuzz SIP services and value added services.