SIP Vulnerability Scan Framework

The purpose of this paper is to provide a framework for detecting vulnerabilities in SIP (Session Initiation Protocol) networks. We focused our studies on the detection of SIP DoS related vulnerabilities in VoIP infrastructures because of their generalization. We try to find weaknesses in SIP enabled entities that an attacker by exploiting them is able to attack the system and affect it. This framework is provided by the concept of penetration testing and is designed to be flexible and extensible, and has the capability to customize for other similar session based protocols. To satisfy the above objectives, the framework is designed with five main modules for discovery, information modeling, operation, evaluation and report. After setting up a test-bed as a typical VoIP system to show the validity of the proposed framework, this system has been implemented as a SIP vulnerability scanner. We also defined appropriate metrics for gathering the performance statistics of SIP components. Our test-bed is deployed by open-source applications and used for validation and also evaluation of the proposed framework. The main contributions of this paper are its non-destructive manner in identifying vulnerabilities and incorporating the penetration testing ideas and steps in the overall architecture of our framework. We also defined appropriate metrics that help us to identify vulnerabilities in a black box penetration testing.