[Voptalk] Need Clarification about VoIP packets

[Mouza Al-Nayeli]

Hello,

I'm working on the SiVus tool to test the vulnerabilities and the threats
with the
VoIP protocol specifically SIP. I'm trying to conduct the BYE attack where I
can
hung up a call between 2 parties, but it is not working.

I'm running the entire environment in my machine. SIP Brekeke server + 2
soft phones
and the SiVus tool, therefore, each phone will not work on the standard
port, but
rather will use another random port number.

Let's say that the first phone has the infos below:

1. 5555 <sip:5555 at 192.168.254.3:49152>

and the second one:

2. 9999 <sip:9999 at 192.168.254.3:14671>

Now, I tried to send a BYE packet with the following information using the
SiVus tool:

BYE sip:9999 at 192.168.254.3 <sip%3A9999 at 192.168.254.3> SIP/2.0
Via: SIP/2.0/UDP 192.168.254.3;branch=lkOJGmrbqvaqZ2
From: 5555 <sip:5555 at 192.168.254.3:5060>;tag=enDVjBvqIX
To: 9999 <sip:9999 at 192.168.254.3:14671>
Call-ID: 9czBSnF3j5Wi at 192.168.254.3
CSeq: 123456 BYE
Contact: <sip:5555 at 192.168.254.3:5060>
Max_forwards: 70
User-Agent: SIVuS Scanner
Content-Type: application/sdp
Subject: SiVuS Test
Expires: 7200
Content-Length: 0


But it is not working, it didn't hung up the call, anyone has an idea about
the prob.??

Looking forward a reply soon,
-- 
Mouza Al-Nayeli
Information Security
200413011
--------------------------------------------------------------------------------------------------------
"Verily, Allah does not change people's condition unless they change their
inner selves" Holy Quran
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.vopsecurity.org/pipermail/voptalk/attachments/20080509/b013a0e9/attachment.html