Skip to main content

sip dos flood

Summary

SIP flood DoS attacks

What it does

Reproduce, detect and exploit the SIP INVITE flood attacks and other methods. This tool allows testers to check the robustness of the target SIP entities, allowing for various mutations of the attack, including rate limiting to bypass network security protection, default monitoring of the target system and various different behaviors for the SIP INVITE flood attack. The attack may be spread out across different SIP extensions or URIs, across different targets.

Tool functionality

The sip dos flood command sends SIP messages in large bulks to trigger denial of service conditions. In the case of most SIP messages, the functionality is rather simple: send large numbers of that particular SIP message as fast as possible, using as many connections as possible. In the case of INVITE messages, extra behaviour is implemented to trigger different conditions. A random user/extension is generated for each request sent by default.

A prober is switched on by default, which will send a SIP message that is known to elicit a response from the target system. This is used to monitor the system and tell if the system starts missing messages or stops responding at all. This is done by sending the same message that is used to initiate the SIP flood. The prober should record the response code so that if it later changes (e.g. from a 200 or 404 to a 5XX server error), it can report this change. If the prober starts missing responses, these get logged as a non-fatal error.

This functionality is the same as the individual tool accessible under sipvicious sip tools ping.

If registration is done using valid credentials, then an unregister should be sent at the end of the test.

Video demonstration

sipvicious sip dos flood

Command format

sipvicious sip dos flood <target1 [target2 [target3 ...]]> [flags]

Flags

      --auth-config strings      Specify SIP authentication configuration. See documentation for details e.g. algorithm:sha-256
      --auth-mode string         Specify how to handle authentication requests (fake|real|ignore); default: ignore unless the -u flag is present
      --caller-mode strings      Specify how to behave during an INVITE flood; format: action or action:duration; (ignore|hangup-trying|hangup-ringing|hangup-call|never-hangup); default: ignore
      --close-conn               Close the connection after sending each message, instead of keeping it alive
  -c, --conn-count int           Number of sockets to use (per target) (default 30)
  -u, --credentials string       Set the username and password in the following format: username:password (e.g. 1000:test123)
  -D, --domain string            Override domain name for the SIP address
  -e, --extension string         Specify a target extension or SIP URI to hit; if not specified, random numeric extensions are used
  -E, --extensions-file string   Specify a file containing extensions or SIP URIs to hit
      --flood-config strings     Specify SIP flood optimisations. See documentation for specification details e.g. nonce-reuse:disable,static-cseq,static-branch
  -f, --from string              Specify a from extension or SIP URI to set the from address; if not specified, a random numeric extension is used
      --max-requests int         Set the maximum number of requests to send
  -m, --method string            Set the method to flood the target with; (REGISTER|SUBSCRIBE|NOTIFY|PUBLISH|MESSAGE|INVITE|OPTIONS|ACK|CANCEL|BYE|PRACK|INFO|REFER|UPDATE) (default "REGISTER")
      --no-prober                Turn off target monitoring that normally sends ping messages to check for errors or timeouts
      --rate string              Specify how many packets to send for each period of time; format: packets/duration; e.g. 100/30ms
      --register                 Maintain a registration throughout the attack; requires -u

Flags inherited from parent commands

      --ca-cert string       TLS CA Certificate
      --client-cert string   TLS client certificate
      --client-key string    TLS client private key
  -C, --config string        configuration file to use (may be JSON, TOML or YAML)
      --debug                set log level to debug
  -T, --duration duration    Stop the tool after a certain amount of time; e.g. 30s
      --logfile string       specify a log filename
      --results string       specify the filename for the result output, defaults to standard output. See documentation for information on file extension meanings
      --srtp string          Specify if either none, dtls or sdes to enforce SRTP for calls; format: method or method:parameters; see full documentation for details (default "none")
      --templates string     Directory to search for template overrides (default ".")
      --tls-key-log string   TLS key log

Examples

sipvicious sip dos flood udp://target:5060 -e 10000
sipvicious sip dos flood tcp://target:5060 -c 80 --duration 15m --rate 100/10ms  -m INVITE
sipvicious sip dos flood tls://target:5061 -c 200 -u 1234:password --flood-config nonce-reuse:disable \
	--register -m INVITE --caller-mode hangup-ringing:30s --caller-mode hangup-call
sipvicious sip dos flood udp://target1.5060 tcp://target1:5060 --auth-mode fake --flood-config nonce-reuse:force
sipvicious sip dos flood udp://target:5060 -T 5s

Advanced examples

# maintain a registration throughout the flood attack using the credentials given
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -u 1000:1500 --register -e 2000

# bypass network security rate limiting by slowing down and prolonging the attack
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -c 100 --duration 100m --rate 1/20ms -e 2000

# target several domains with different extensions limiting maximum requests
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 tcp://demo.sipvicious.pro:5060 tls://demo.sipvicious.pro:5060 -e 2000,3000,4000 --max-requests 1000

# using subscribe method and not incrementing cseq no. with no ping probes
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -e 2000 -m subscribe --flood-config static-cseq --no-prober

# flood using fake authentication handling and forcing nonce-reusing
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -e 2000 --auth-mode fake --flood-config nonce-reuse:force

# flood using invite method with invite mode set to both call-hangups and hangup-ringing and also using 100 sockets, forcing a specific domain while maintaining a static branch number
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -m invite --flood-config static-branch --caller-mode hangup-call --caller-mode hangup-ringing:60s --conn-count 100 --domain siteonsip.tld -e 2000

# using a list of extensions to target and terminating connections after sending a message
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 --extensions-file extensions.txt --close-conn

# prolong the flood attack using the never-hangup mode during an INVITE flood
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -u 1000:1500 --register -E ext.txt --caller-mode never-hangup -m invite

# using the publish method for the flood attack
sipvicious sip dos flood udp://demo.sipvicious.pro:5060 -e 2000 --flood-config nonce-reuse:disable -m publish

Exit codes

CodeDescription
40A security issue is raised when the prober detects SIP-level or network-level errors
30A network connectivity issue is raised when the connection fails before the attack is started

Full flag documentation

Flag: --auth-config

Specify SIP authentication configuration. This flag accepts the following values:

  • algorithm:value where value may be md5, md5-sess, sha-256, sha-256-sess, sha-512-256 or sha-512-256-sess. This value will force the tool to calculate the authorization response based on the first WWW-Authenticate or Proxy-Authenticate header field that matches this algorithm. If no match is found then the first WWW-Authenticate or Proxy-Authenticate header is selected.

Flag: --auth-mode

Specify how authentication requests are handled. This can be either fake, real or ignore. By default, authentication requests are ignored unless credentials are specified using the -u flag. When credentials are specified, the default behaviour is to make use of real credentials. When fake is specified, the challenge response is generated based on the challenge, but no credentials are actually used. This has the benefit of generating a failed authentication request, thus possibly triggering DoS at authentication stage, while requiring no extra calculations to be done from the attacker’s side.

Note: authentication may slow down the attack, thus the value ignore is desired when speed is needed.

Flag: --ca-cert

The CA cert can be passed when making use of client certificate authentication. The file should be formatted as PEM.

Flag: --caller-mode

The flag caller-mode allows one to specify how to behave during an INVITE flood. The value of this flag could be one of the following actions:

  • ignore which does not wait for SIP INVITE responses; this is the default
  • hangup-trying which sends a CANCEL as soon as a 100 Trying message is received
  • hangup-ringing which sends a CANCEL as soon as a 180 Ringing is received
  • hangup-call which hangs up (by sending a BYE) when a call is picked up (i.e. when a 200 OK is received)
  • never-hangup which handles the call flow normally without hanging up

Additionally, the action value may be preceded by a colon and a duration value. This duration should be specified when the action should be taken after a specific time (e.g. 2s or 300ms). For example, hangup-ringing:300ms.

Flag: --client-cert

The client certificate must be passed when making use of client certificate authentication. The file should be formatted as PEM.

Flag: --client-key

The client key must be passed when making use of client certificate authentication. The file should be formatted as PEM.

Flag: --close-conn

The default connection behaviour is to try to keep all connections alive or, in the case of UDP, to reuse the same socket. This flag overrides this behaviour so that the connection is closed after each message is sent. This can uncover vulnerabilities related to socket handling in relation to SIP signalling.

Flag: -C, --config

Specify a configuration file which may be a JSON, TOML and YAML config format. To get the default settings and figure out which settings are available, one may run the sipvicious utils dump config command. This is typically used to create a template configuration that can then be edited as need be.

These settings may be overwritten when the corresponding flag is explicitly set, if one is present.

Flag: -c, --conn-count

The conn-count allows setting of how many sockets should be used concurrently to spread out the attack.

Flag: -u, --credentials

Specify valid credentials so that SIP flooding can be done authenticated. The following format is used username:password (e.g. 1000:test123). When not specified, if required, the tool will send fake challenge responses.

Additionally, a realm may be specified as a third parameter (e.g. 1000:test123:snowflake).

Note: This does not set the correct SIP To and From headers, which might cause authorization checks to fail. Set the -e and --from flags if this is required.

Flag: --debug

Tells the logger to print out debug messages.

Flag: -D, --domain

A domain name can be specified so that the SIP URI contains that particular domain rather than the one specified as the target. This is useful for targets that expect a particular domain name.

Flag: -T, --duration

Specify the maximum duration of the attack so that it stops after a certain time. Examples include:

  • 30s
  • 10m
  • 24h

Flag: -e, --extension

This flag allows users to target a particular extension, overriding the default behaviour of targeting random extensions. The value can be either just the SIP extension/username (e.g. 1234) or a SIP URI (e.g. sip:user@example.org).

This flag may not be used with dictionary flag.

Flag: -E, --extensions-file

Specify a file containing potential SIP extensions or SIP URIs to be used in the flood attack. This flag is useful when spreading a SIP INVITE flood attack across different targets behind a SIP proxy. Examples include:

1234
testuser
sip:testuser2@example.org

Note that although this may be used with other SIP methods, such as REGISTER with valid credentials, this may lead to unexpected behaviour from a SIP protocol point of view.

This flag may not be used with extension flag.

Flag: --flood-config

Specify SIP flood optimisations. This flag accepts the following values:

  • nonce-reuse:auto|force|disable
  • static-branch
  • static-cseq

If a server supports nonce reuse, an attack involving authentication may be sped up by supporting that functionality. This is done by sampling responses and looking for an authentication request if given the correct credentials using the -u flag. By default, the tool tries to make use of nonce-reuse if the target supports it. Nonce-reuse can be forced by passing the value of force or completely disabled by passing the value of disabled to the nonce-reuse flag.

Disabling nonce-reuse may be useful when trying to reproduce a DoS issue involving nonce generation.

Warning: disabling nonce-reuse slows down any attack.

The static-branch option may lead to DoS conditions that are not exhibited when using random or incremental values.

The static-cseq option may lead to DoS conditions that are not exhibited when using random or incremental values.

Flag: -f, --from

This flag allows users to set the From address, overriding the default behaviour of setting a random extension or the username in the credentials when one is provided. The value can be either just the SIP extension/username (e.g. 1234) or a SIP URI (e.g. sip:user@example.org).

Flag: --logfile

When the logfile flag is specified, a log file is created in the location specified and logs are generated in this file instead of being sent to standard output. If the filename ends with a .json file extension, then the output format is in JSON, otherwise it defaults to text format.

Flag: --max-requests

Specify the maximum number of messages to send before stopping the attack.

Flag: -m, --method

The SIP flood tool supports the following SIP methods:

  • REGISTER
  • SUBSCRIBE
  • NOTIFY
  • PUBLISH
  • MESSAGE
  • INVITE
  • OPTIONS
  • ACK
  • CANCEL
  • BYE
  • PRACK
  • INFO
  • REFER
  • UPDATE

In the case of INVITE messages, the caller-mode method specifies extra parameters that are only specific to this method.

Flag: --no-prober

Switches off the default prober which sends a SIP message to detect errors and issues during an attack.

Flag: --rate

Rate allows one to limit the attack below a certain rate. If the value is 100/30ms, that means that 100 packets should be spread out evenly across 30 milliseconds across all the connections per target.

Flag: --register

Register requires credentials to be passed so that a REGISTER message is sent to authenticate with a registrar server before starting the attack. The registration is maintained as per SIP standards, so that authentication does not time out.

Flag: --results

When the results flag is specified, upon completing the test, it outputs the results to the specified filename. The format for this output file is text unless the filename ends with a .json file extension. In that case, the result output is that of JSON.

The schema for the JSON output for this submodule can be found here.

Flag: --srtp

The srtp flag when specified, allows users to set the SRTP mode. By default, outgoing calls do not make use of SRTP, while incoming calls automatically handle SRTP depending on the SDP body of the incoming INVITE message. When the srtp flag is set to none, incoming calls do not make use of SRTP, regardless of the SDP body in an incoming INVITE. The srtp mode can also be either dtls or sdes. In both dtls and sdes modes, the parameters are not required and will be generated randomly as need be.

Options for both dtls and sdes mode may be passed after a colon. For example:

  • --srtp dtls:cert.crt:cert.key[:ca.crt] where the first argument after the mode (dtls) is the public certificate cert.crt, then the private key cert.key and finally, the optional certificate authority file ca.crt
  • --srtp sdes:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj where the argument is the base64 encoded cryptographic master key appended with the master salt.

Note that in the case of sdes key, the master key needs to be a valid length, which is 30 octets, for the default crypto-suite AES_CM_128_HMAC_SHA1_80.

Flag: --templates

Allows one to set the template directory which is used to load (or save) the SIP templates.

To get the default SIP templates, make use of the sipvicious sip utils dump templates command.

Flag: --tls-key-log

The TLS key log creates a file with the TLS key that can then be used to decrypt the TLS stream in tools that support it, such as Wireshark.

Future enhancements

Rate limit test

Testing of different rate limits would be useful to identify the ideal sending rate. A specific function could be present to find the right sending rate that is allowed by the target system. An extended feature would be to be able to automatically find that rate and then intelligently stay under it without any configuration of the tool.

Update Dictionary to support credentials

The current dictionary flag is useful for INVITE flood and perhaps some other methods but not so much for REGISTER flood, when credentials are provided, where it may only make sense to register to a specific account when credentials are specified.

Spread attack across different authenticated users

Functionality to support spreading the flooding across different users may be needed to bypass user specific checks or limitations.

JSON schema

The following is the JSON schema for the JSON output of this tool:

{
  "type": "object",
  "properties": {
    "status": {
      "type": "object",
      "properties": {
        "returncode": { "type": "integer" },
        "description": { "type": "string" }
      }
    },
    "targets": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "target": { "type": "string" },
          "status": {
            "type": "object",
            "properties": {
              "returncode": { "type": "integer" },
              "description": { "type": "string" }
            }
          },
          "results": {
            "type": "object",
            "properties": {
            }
          },
          "issues": {
            "type": "object",
            "properties": {
            }
          }
        }
      }
    }
  }
}