{"id":477,"date":"2014-06-04T09:01:08","date_gmt":"2014-06-04T09:01:08","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=477"},"modified":"2023-03-24T18:18:56","modified_gmt":"2023-03-24T12:48:56","slug":"voip-penetration-testing-part-2","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/","title":{"rendered":"VoIP Penetration Testing Part-II"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2014\/06\/Better-secure-Copy-1024x584.png\"  class=\"sh-overlay-item sh-table-cell ls-is-cached lazyloaded\" data-rel=\"lightcase\" title=\"Better secure Copy - Varutra Consulting\"><\/p>\n<p style=\"text-align: justify;\">In the previous tutorial <a href=\"https:\/\/www.varutra.com\/blog\/?p=382\">VoIP Penetration Testing Part-I<\/a> we have learnt on how to do Information Gathering\/ Footprinting using Google dorks and identify the target IP address of the TFTP server. Now let&#8217;s start with the scanning phase.<\/p>\n<p><strong>Note<\/strong>: <em>I have used dynamic IP address, so in my case VoIP Server IP is 192.168.1.108. In your case it may be different.<\/em><\/p>\n<p>&nbsp;<\/p>\n<h3><strong>In scanning phase we will use following techniques,<\/strong><\/h3>\n<h4>1.\u00a0 <b>Footprinting:<br \/>\n<\/b><\/h4>\n<p>TOOL:<\/p>\n<ul>\n<li><b>\u00a0\u00a0\u00a0 <\/b><b>SMAP : <\/b><\/li>\n<\/ul>\n<p style=\"text-align: left;\">SMAP<b>\u00a0 <\/b>is a simple scanner for SIP, enabled devices. SMAP sends off various SIP requests awaiting responses from SIP enabled DSL router, proxies and user agents.<\/p>\n<p style=\"text-align: left;\"><span style=\"color: #3366ff;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<span style=\"color: #888888;\">\u00a0 <span style=\"text-decoration: underline;\"><strong>SMAP Usage<\/strong><\/span>:<\/span><\/span><\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/1.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-484 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/1.jpg\" alt=\"SMAP-1\" width=\"624\" height=\"336\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/1.jpg 624w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/1-300x162.jpg 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><\/p>\n<p>Scanning single host using SMAP:<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/2.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-485 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/2.jpg\" alt=\"SMAP-2\" width=\"627\" height=\"174\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/2.jpg 627w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/2-300x83.jpg 300w\" sizes=\"(max-width: 627px) 100vw, 627px\" \/><\/a><\/p>\n<p>Now identifying SIP enabled host.<\/p>\n<p>Use SMAP to fingerprint the server\/client type and version:<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/3.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-486 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/3.jpg\" alt=\"SMAP-3\" width=\"626\" height=\"203\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/3.jpg 626w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/3-300x97.jpg 300w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">Another useful feature of SMAP is <strong>-l<\/strong> argument to go in learning mode to provide more useful information.<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/41.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-487 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/41.jpg\" alt=\"4(1)\" width=\"622\" height=\"27\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/41.jpg 622w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/41-300x13.jpg 300w\" sizes=\"(max-width: 622px) 100vw, 622px\" \/><\/a><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/42.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-488 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/42.jpg\" alt=\"SMAP-4(2)\" width=\"620\" height=\"323\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/42.jpg 620w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/42-300x156.jpg 300w\" sizes=\"(max-width: 620px) 100vw, 620px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>\u00a0\u00a0\u00a0 SIPSAK<\/strong> :<\/li>\n<\/ul>\n<p style=\"text-align: left;\">SIPSAK is a small command line tool for developers and administrators of SIP applications.<\/p>\n<p><span style=\"color: #3366ff;\"><b><span style=\"color: #888888;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <span style=\"text-decoration: underline;\">SIPSAK Usage<\/span>:<\/span><\/b><\/span><\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/5.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-492 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/5.jpg\" alt=\"5\" width=\"626\" height=\"271\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/5.jpg 626w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/5-300x130.jpg 300w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><\/a><\/p>\n<p>It can be used for some simple tests on SIP applications and devices.<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/6.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-493 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/6.jpg\" alt=\"6\" width=\"628\" height=\"374\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/6.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/6-300x179.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<ul>\n<li><strong>\u00a0\u00a0\u00a0\u00a0 SVMAP<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">is a free and Open Source scanner to identify SIP devices and PBX servers on a target network. It can also be helpful for systems administrators when used as a network inventory tool. SVMAP was designed to be faster by specifically targeting SIP over UDP.<\/p>\n<p><span style=\"color: #888888;\"><b>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <span style=\"text-decoration: underline;\">SVMAP Usage<\/span><\/b>:<\/span><\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/7.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-495 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/7.jpg\" alt=\"7\" width=\"627\" height=\"208\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/7.jpg 627w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/7-300x100.jpg 300w\" sizes=\"(max-width: 627px) 100vw, 627px\" \/><\/a><\/p>\n<p>Scanning single IP using svmap:<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/8.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-496 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/8.jpg\" alt=\"8\" width=\"628\" height=\"86\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/8.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/8-300x41.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>You can also specify a name instead of an IP address:<\/p>\n<p style=\"text-align: center;\"><b>.\/svmap sipvicious.org<\/b><\/p>\n<p>Performing fingerprint (- -fp) scanning using svmap:<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/91.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-497 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/91.jpg\" alt=\"9(1)\" width=\"624\" height=\"33\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/91.jpg 624w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/91-300x16.jpg 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/92.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-498 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/92.jpg\" alt=\"9(2)\" width=\"624\" height=\"79\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/92.jpg 624w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/92-300x38.jpg 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><b><\/b><\/p>\n<p>&nbsp;<\/p>\n<p><!-- [if gte mso 9]&gt;--><\/p>\n<p>Normal<br \/>\n0<\/p>\n<p>false<br \/>\nfalse<br \/>\nfalse<\/p>\n<p>EN-US<br \/>\nX-NONE<br \/>\nX-NONE<\/p>\n<h4 class=\"MsoListParagraph\" style=\"margin-left: .25in; text-indent: -.25in;\"><b>\u00a0 <\/b>2.\u00a0 <strong>ICMP Ping Sweeps: \u00a0\u00a0<\/strong><\/h4>\n<p>In ICMP Ping Sweeps, pinging includes sending ICMP type 8 packets (ICMP ECHO REQUEST) to an IP address. If the router or firewall does not block ICMP the host will reply with an ICMP type 0 packet (ICMP ECHO REPLY).<\/p>\n<p>TOOL:<\/p>\n<ul>\n<li style=\"text-align: left; margin-left: 50px;\">fping<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Nmap<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">SuperScan<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Nessus<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>\u00a0\u00a0\u00a0\u00a0 fping:<\/strong><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">fping is used with the command-line option &#8211;<strong>g<\/strong> to specify the range of hosts to scan, along with the <strong>-s<\/strong> option.<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/10.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-509 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/10.jpg\" alt=\"10\" width=\"622\" height=\"342\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/10.jpg 622w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/10-300x165.jpg 300w\" sizes=\"(max-width: 622px) 100vw, 622px\" \/><\/a><\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0<strong> NMAP Ping Scan (-sP):<\/strong><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">This scan type lists the hosts within the specified range that responded to a ping. It allows you to detect, which computers are online rather than which ports are open. Four methods exist within Nmap for ping sweeping. The first method sends an ICMP ECHO REQUEST (ping request) packet to the destination system. If an ICMP ECHO REPLY is received, the system is up, and ICMP packets are not blocked. If there is no response to the ICMP ping, Nmap will try a &#8220;TCP Ping&#8221;, to determine whether ICMP is blocked, or if the host is really not online.<\/p>\n<p style=\"text-align: justify;\">A TCP Ping sends either a SYN or an ACK packet to any port (80 is the default) on the remote system. If RST , or a SYN\/ACK , is returned, then the remote system is online. If the remote system does not respond, either it is offline, or the chosen port is filtered, and thus not responding to anything. When you run Nmap ping scan as root, the default is to use the ICMP and ACK methods.<\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/11.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-510 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/11.jpg\" alt=\"11\" width=\"624\" height=\"123\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/11.jpg 624w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/11-300x59.jpg 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/12.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-511 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/12.jpg\" alt=\"12\" width=\"628\" height=\"458\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/12.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/12-300x219.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 3.\u00a0 <strong>ARP Pings: <\/strong><\/h4>\n<p style=\"text-align: justify;\">Arping is a command line tool for ARP pinging IP and MAC addresses. Let us find out the reachability of an IP address on the local ethernet with arping.<\/p>\n<p style=\"text-align: center;\"><b>arping\u00a0 \u2013i\u00a0 eth0 \u2013c 5 192.168.1.108<\/b><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/13.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-518 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/13.jpg\" alt=\"13\" width=\"624\" height=\"170\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/13.jpg 624w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/13-300x82.jpg 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><\/p>\n<p style=\"text-align: left;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Where,<\/p>\n<p style=\"text-align: left;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8211;<strong>i<\/strong> eth0 : Specify network interface.<\/p>\n<p style=\"text-align: left;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &#8211;<strong>c<\/strong> 5 : Stop after sending 5 ARP REQUEST packets.<\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 4.\u00a0 <strong>TCP Ping Scan:<br \/>\n<\/strong><\/h4>\n<p style=\"text-align: justify;\">A TCP ping scan involves sending a TCP SYN-flagged or ACK-flagged packet to a commonly used TCP port on the target host. ACK packets are more useful, because they can be used to bypass stateless firewalls that monitor only for incoming SYNs. By default, Nmap uses a SYN packet on port 80 to probe, but it can be customized from the command line to use an ACK packet on a different port using the -PT option<\/p>\n<p>TOOL:<\/p>\n<ul>\n<li>\u00a0 \u00a0 \u00a0 <strong>NMAP:<\/strong><\/li>\n<\/ul>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/14.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-519 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/14.jpg\" alt=\"14\" width=\"621\" height=\"282\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/14.jpg 621w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/14-300x136.jpg 300w\" sizes=\"(max-width: 621px) 100vw, 621px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 5.\u00a0 <strong>Hping3:<\/strong><\/h4>\n<p style=\"text-align: justify;\">\u00a0Hping3 is one of the tools for security auditing and testing of firewalls and networks.<\/p>\n<p style=\"text-align: left;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 A subset of stuff you can do using hping:<\/p>\n<ul>\n<li style=\"text-align: left; margin-left: 50px;\">Firewall testing<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Advanced port scanning<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Network testing, using different protocols, TOS, fragmentation<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Manual path MTU discovery<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Advanced trace route, under all the supported protocols<\/li>\n<li style=\"text-align: left; margin-left: 50px;\">Remote OS fingerprinting<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0\u00a0<strong> TCP SYN SCAN<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: center;\"><strong>hping3 -S <strong>-c 4<\/strong> 192.168.1.108 -p 21<br \/>\n<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/15.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-525 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/15.jpg\" alt=\"15\" width=\"628\" height=\"212\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/15.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/15-300x101.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p style=\"text-align: left;\">\u00a0<strong>NOTE<\/strong>: <em>I had to use -c 4 flag in order to send the SYN packet four times, otherwise hping will continue sending probes.<\/em><\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<strong> TCP ACK SCAN<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: left;\">TCP ACK Scan can be performed by setting up <strong>ACK<\/strong> flag in probe packets;<\/p>\n<p style=\"text-align: left;\"><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hping3 -A 192.168.1.108 -p 80 -c 1<\/strong><\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <strong>XMAS SCAN<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: left;\">XMAS Scan can be performed by setting <strong>FINISH,PUSH,URGENT<\/strong> flag in probe packets;<\/p>\n<p style=\"text-align: center;\"><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hping3 -F -P -U 192.168.1.108 -p 80 -c 1<\/strong><\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <strong>UDP SCAN<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: left;\">hping can be configured to operate in UDP mode by\u00a0 specifying <strong>-2<\/strong> in the command line.<\/p>\n<p style=\"text-align: center;\"><strong>\u00a0\u00a0\u00a0\u00a0 hping3 -2 192.168.1.108 -p 161 -c 1<\/strong><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 6.\u00a0 <strong>SNMP Sweeps:<\/strong><\/h4>\n<p>Simple Network Management Protocol (SNMP) scanning is another effective method of determining active network equipment.SNMP v3 is based on stronger encryption such as AES and 3DES.<\/p>\n<p style=\"text-align: center;\"><strong>nmap \u2013sU 192.168.1.108<\/strong><\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/16.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-534 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/16.jpg\" alt=\"16\" width=\"628\" height=\"243\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/16.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/16-300x116.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 7.\u00a0 <strong>Port Scanning:<\/strong><\/h4>\n<p style=\"text-align: left;\">TOOL:<\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <strong>NMAP:<\/strong><\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Nmap (&#8220;Network Mapper&#8221;) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service up time. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters\/firewalls are in use, and dozens of other characteristics.<\/p>\n<p style=\"text-align: left;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <span style=\"text-decoration: underline;\">TCP SYN SCAN<\/span>:<\/p>\n<p style=\"text-align: center;\"><strong>nmap 192.168.1.108<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/17.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-535 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/17.jpg\" alt=\"17\" width=\"628\" height=\"289\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/17.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/17-300x138.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p style=\"text-align: left;\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0\u00a0\u00a0 <span style=\"text-decoration: underline;\">Version Detection<\/span>:<\/p>\n<p style=\"text-align: center;\"><b>nmap -sV 192.168.1.108<\/b><\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/18.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-536 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/18.jpg\" alt=\"18\" width=\"628\" height=\"337\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/18.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/18-300x161.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 8.\u00a0 <strong>Host\/Device OS Identification:<\/strong><\/h4>\n<p>Nmap has a built-in OS detection option i.e. -O<\/p>\n<p style=\"text-align: center;\"><strong>Nmap \u2013O \u2013PO 192.168.1.108<\/strong><\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/19.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-539 size-full aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/19.jpg\" alt=\"19\" width=\"628\" height=\"402\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/19.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/19-300x192.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h4 style=\"text-align: left;\">\u00a0 9.\u00a0 <strong>Banner Grabbing:<\/strong><\/h4>\n<p style=\"text-align: left;\">Banner grabbing, is a method of connecting to a port on a remote target to determine further information about the associated services running on that specific port(s).<\/p>\n<p>TOOL:<\/p>\n<ul>\n<li>\u00a0\u00a0\u00a0\u00a0<strong>Netcat<\/strong>:<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\u00a0Netcat is a featured networking utility, which reads and writes data across network connections, using the TCP\/IP protocol.<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/20.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-540 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/20.jpg\" alt=\"20\" width=\"628\" height=\"196\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/20.jpg 628w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/20-300x94.jpg 300w\" sizes=\"(max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<p>Written By,<\/p>\n<p><em>Attack &amp; PenTest Team,<\/em><\/p>\n<p><em>Varutra Consulting<\/em><\/p>\n<p><!-- [if gte mso 9]&gt;--><\/p>\n<p><!-- [if gte mso 10]&gt;--><\/p>\n<p>\/* Style Definitions *\/<br \/>\ntable.MsoNormalTable<br \/>\n{mso-style-name:&#8221;Table Normal&#8221;;<br \/>\nmso-tstyle-rowband-size:0;<br \/>\nmso-tstyle-colband-size:0;<br \/>\nmso-style-noshow:yes;<br \/>\nmso-style-priority:99;<br \/>\nmso-style-qformat:yes;<br \/>\nmso-style-parent:&#8221;&#8221;;<br \/>\nmso-padding-alt:0in 5.4pt 0in 5.4pt;<br \/>\nmso-para-margin-top:0in;<br \/>\nmso-para-margin-right:0in;<br \/>\nmso-para-margin-bottom:10.0pt;<br \/>\nmso-para-margin-left:0in;<br \/>\nline-height:115%;<br \/>\nmso-pagination:widow-orphan;<br \/>\nfont-size:11.0pt;<br \/>\nfont-family:&#8221;Calibri&#8221;,&#8221;sans-serif&#8221;;<br \/>\nmso-ascii-font-family:Calibri;<br \/>\nmso-ascii-theme-font:minor-latin;<br \/>\nmso-hansi-font-family:Calibri;<br \/>\nmso-hansi-theme-font:minor-latin;<br \/>\nmso-bidi-font-family:&#8221;Times New Roman&#8221;;<br \/>\nmso-bidi-theme-font:minor-bidi;}<\/p>","protected":false},"excerpt":{"rendered":"<p>In the previous tutorial VoIP Penetration Testing Part-I we have learnt on how to do Information Gathering\/ Footprinting using Google dorks and identify the target&#8230;<\/p>\n","protected":false},"author":3,"featured_media":3259,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[261,266,273,274,275,57],"tags":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"kalpadmin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Varutra Consulting\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"VoIP Penetration Testing - Scanning Against VoIP Server\" \/>\n\t\t<meta property=\"og:description\" content=\"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t\t<meta property=\"og:image:height\" content=\"750\" \/>\n\t\t<meta property=\"article:section\" content=\"Ethical Hacking\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2014-06-04T09:01:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-24T12:48:56+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"VoIP Penetration Testing - Scanning Against VoIP Server\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"kalpadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#article\",\"name\":\"VoIP Penetration Testing - Scanning Against VoIP Server\",\"headline\":\"VoIP Penetration Testing Part-II\",\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/admin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2014\\\/06\\\/voip-Copy.png\",\"width\":1280,\"height\":750,\"caption\":\"voip - Copy\"},\"datePublished\":\"2014-06-04T09:01:08+05:30\",\"dateModified\":\"2023-03-24T18:18:56+05:30\",\"inLanguage\":\"en-US\",\"commentCount\":1,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#webpage\"},\"articleSection\":\"Ethical Hacking, Security Advisory, Security Best Practices, Security Hardening, VoIP Penetration Testing, Vulnerability Disclosure\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/category\\\/vulnerability-disclosure\\\/#listItem\",\"name\":\"Vulnerability Disclosure\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/category\\\/vulnerability-disclosure\\\/#listItem\",\"position\":2,\"name\":\"Vulnerability Disclosure\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/category\\\/vulnerability-disclosure\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#listItem\",\"name\":\"VoIP Penetration Testing Part-II\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#listItem\",\"position\":3,\"name\":\"VoIP Penetration Testing Part-II\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/category\\\/vulnerability-disclosure\\\/#listItem\",\"name\":\"Vulnerability Disclosure\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\",\"name\":\"Varutra\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Varutra-Found-e1612984024606.jpg\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/admin\\\/#author\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/admin\\\/\",\"name\":\"kalpadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d69b4bf504d3e2e3c6ad0c424e16bcb2?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"kalpadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#webpage\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/\",\"name\":\"VoIP Penetration Testing - Scanning Against VoIP Server\",\"description\":\"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/admin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/admin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2014\\\/06\\\/voip-Copy.png\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#mainImage\",\"width\":1280,\"height\":750,\"caption\":\"voip - Copy\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/voip-penetration-testing-part-2\\\/#mainImage\"},\"datePublished\":\"2014-06-04T09:01:08+05:30\",\"dateModified\":\"2023-03-24T18:18:56+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"name\":\"Varutra Consulting\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>VoIP Penetration Testing - Scanning Against VoIP Server<\/title>\n\n","aioseo_head_json":{"title":"VoIP Penetration Testing - Scanning Against VoIP Server","description":"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.","canonical_url":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#article","name":"VoIP Penetration Testing - Scanning Against VoIP Server","headline":"VoIP Penetration Testing Part-II","author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/admin\/#author"},"publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/voip-Copy.png","width":1280,"height":750,"caption":"voip - Copy"},"datePublished":"2014-06-04T09:01:08+05:30","dateModified":"2023-03-24T18:18:56+05:30","inLanguage":"en-US","commentCount":1,"mainEntityOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#webpage"},"isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#webpage"},"articleSection":"Ethical Hacking, Security Advisory, Security Best Practices, Security Hardening, VoIP Penetration Testing, Vulnerability Disclosure"},{"@type":"BreadcrumbList","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3#listItem","position":1,"name":"Home","item":"https:\/\/www.varutra.com\/varutravrt3","nextItem":{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/#listItem","name":"Vulnerability Disclosure"}},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/#listItem","position":2,"name":"Vulnerability Disclosure","item":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#listItem","name":"VoIP Penetration Testing Part-II"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#listItem","position":3,"name":"VoIP Penetration Testing Part-II","previousItem":{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/#listItem","name":"Vulnerability Disclosure"}}]},{"@type":"Organization","@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization","name":"Varutra","description":"Secure your digital world with our Cybersecurity services.","url":"https:\/\/www.varutra.com\/varutravrt3\/","logo":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Varutra-Found-e1612984024606.jpg","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#organizationLogo"},"image":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/admin\/#author","url":"https:\/\/www.varutra.com\/varutravrt3\/author\/admin\/","name":"kalpadmin","image":{"@type":"ImageObject","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/d69b4bf504d3e2e3c6ad0c424e16bcb2?s=96&d=mm&r=g","width":96,"height":96,"caption":"kalpadmin"}},{"@type":"WebPage","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#webpage","url":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/","name":"VoIP Penetration Testing - Scanning Against VoIP Server","description":"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#website"},"breadcrumb":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#breadcrumblist"},"author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/admin\/#author"},"creator":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/admin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2014\/06\/voip-Copy.png","@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#mainImage","width":1280,"height":750,"caption":"voip - Copy"},"primaryImageOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/#mainImage"},"datePublished":"2014-06-04T09:01:08+05:30","dateModified":"2023-03-24T18:18:56+05:30"},{"@type":"WebSite","@id":"https:\/\/www.varutra.com\/varutravrt3\/#website","url":"https:\/\/www.varutra.com\/varutravrt3\/","name":"Varutra Consulting","description":"Secure your digital world with our Cybersecurity services.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"}}]},"og:locale":"en_US","og:site_name":"Varutra Consulting","og:type":"article","og:title":"VoIP Penetration Testing - Scanning Against VoIP Server","og:description":"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.","og:url":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/","og:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png","og:image:secure_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png","og:image:width":"1280","og:image:height":"750","article:section":"Ethical Hacking","article:published_time":"2014-06-04T09:01:08+00:00","article:modified_time":"2023-03-24T12:48:56+00:00","twitter:card":"summary_large_image","twitter:title":"VoIP Penetration Testing - Scanning Against VoIP Server","twitter:description":"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.","twitter:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png","twitter:label1":"Written by","twitter:data1":"kalpadmin","twitter:label2":"Est. reading time","twitter:data2":"5 minutes"},"aioseo_meta_data":{"post_id":"477","title":"VoIP Penetration Testing&nbsp;- Scanning Against VoIP Server","description":"Learn on how to do scanning against VoIP Server using various techniques such as Footprinting, ICMP Ping Sweeps, ARP Pings, TCP Ping Scan, and many more.","keywords":[],"keyphrases":{"focus":{"keyphrase":"VOIP","score":80,"analysis":{"keyphraseInTitle":{"score":9,"maxScore":9,"error":0},"keyphraseInDescription":{"score":9,"maxScore":9,"error":0},"keyphraseLength":{"score":9,"maxScore":9,"error":0,"length":1},"keyphraseInURL":{"score":5,"maxScore":5,"error":0},"keyphraseInIntroduction":{"score":9,"maxScore":9,"error":0},"keyphraseInSubHeadings":{"score":3,"maxScore":9,"error":1},"keyphraseInImageAlt":{"score":3,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2014\/06\/voip-Copy.png","og_image_width":"1280","og_image_height":"750","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Ethical Hacking","og_article_tags":[],"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"reviewed_by":null,"open_ai":null,"created":"2021-10-27 15:18:10","updated":"2026-05-24 09:04:14","ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":"2026-05-22 12:30:30","focus_keyword":"VOIP","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/\" title=\"Vulnerability Disclosure\">Vulnerability Disclosure<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tVoIP Penetration Testing Part-II\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.varutra.com\/varutravrt3"},{"label":"Vulnerability Disclosure","link":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/"},{"label":"VoIP Penetration Testing Part-II","link":"https:\/\/www.varutra.com\/varutravrt3\/voip-penetration-testing-part-2\/"}],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/477"}],"collection":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/comments?post=477"}],"version-history":[{"count":6,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/477\/revisions"}],"predecessor-version":[{"id":21245,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/477\/revisions\/21245"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media\/3259"}],"wp:attachment":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media?parent=477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/categories?post=477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/tags?post=477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}