C2 Connections
Exploring VoIP Security: Understanding SIP and RTP Protocols
This lab immerses you in the realm of internet-based voice communication, where Voice over Internet Protocol (VoIP) is rapidly emerging as the industry standard. As organizations and individuals increasingly adopt this technology for seamless and cost-effective communication, cyber threats targeting these systems are also on the rise.
Attackers seek to exploit vulnerabilities in VoIP infrastructure to intercept calls, manipulate data, or launch unauthorized access attempts.
This challenge, developed by Craw Security, is designed to provide an in-depth exploration of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP)—two critical protocols that govern VoIP communication.
By analyzing their attributes, participants will gain valuable insights into how these protocols function, the potential security risks they face, and the defensive measures necessary to safeguard them against malicious activities.
Question 1.
Which protocol is responsible for transporting data in this network traffic?
Question 2.
The attacker utilized a collection of scanning tools from the same suite. What is the name of this suite?
Question 3.
Can you identify the User-Agent of the victim system from the captured traffic?
Question 4.
Which tool was specifically used to target the extensions 100, 101, 102, 103, and 111?
Question 5.
Which extension in the honeypot is accessible without requiring authentication?
Question 6.
What is the total number of extensions that were scanned during the attack?
Question 7.
A real SIP client appears in the trace. What is its corresponding User-Agent?
Question 8.
What is the most recent 11-digit phone number dialed from extension 101 among the several real-world phone numbers?
Question 9.
What are the default credentials used in the attempted basic authentication?
Question 10.
Which codec is being used in the RTP stream?
Question 11.
What is the duration of the sampling time in milliseconds for the RTP stream?
Question 12.
What was the password for the account associated with username 555?
Question 13.
Which RTP packet header field can be used to reorder out-of-sync RTP packets into the correct sequence?
Question 14.
A secret hidden message is embedded in the trace. Can you hear it?
Question 15.
Go to packet No.25 and check the packet comment and drop the last flag