Bluebox-ng – Node.js VoIP penetration testing framework

Features

• Auto VoIP/UC penetration test
• Report generation
• Performance
• RFC compliant
• SIP TLS and IPv6 support
• SIP over websockets (and WSS) support (RFC 7118)
• SHODAN, exploitsearch.net and Google Dorks
• SIP common security tools (scan, extension/password bruteforce, etc.)
• Authentication and extension brute-forcing through different types of SIP requests
• SIP Torture (RFC 4475) partial support
• SIP SQLi check
• SIP denial of service (DoS) testing
• Web management panels discovery
• DNS brute-force, zone transfer, etc.
• Other common protocols brute-force: Asterisk AMI, MySQL, MongoDB, SSH, (S)FTP, HTTP(S), TFTP, LDAP, SNMP
• Some common network tools: whois, ping (also TCP), traceroute, etc.
• Asterisk AMI post-explotation
• Dumb fuzzing
• Automatic exploit searching (Exploit DB, PacketStorm, Metasploit)
• Automatic vulnerability searching (CVE, OSVDB, NVD)
• Geolocation
• Command completion
• Cross-platform support

Install

• Install Node.js: https://nodejs.org/download

npm i -g bluebox-ng

Download