| name | sip-protocol-assistant |
| description | Expert assistance for Session Initiation Protocol (SIP) tasks including message construction, protocol analysis, security assessments, and VoIP pentesting. Use this skill whenever the user needs to understand SIP methods, create SIP messages, analyze SIP traffic, perform SIP security testing, work with SIP digest authentication, or troubleshoot VoIP systems. Trigger for any request involving SIP, VoIP, PBX, Asterisk, SIP headers, SIP response codes, or session initiation protocol. |
SIP Protocol Assistant
A comprehensive skill for working with Session Initiation Protocol (SIP) - the signaling protocol used for establishing, modifying, and terminating multimedia sessions over IP networks.
What This Skill Does
This skill helps you:
- Construct and parse SIP messages (INVITE, REGISTER, BYE, OPTIONS, etc.)
- Understand SIP response codes and their meanings
- Perform SIP security assessments and pentesting
- Calculate SIP digest authentication responses
- Analyze SIP traffic and troubleshoot VoIP issues
- Harden SIP deployments against common vulnerabilities
Core SIP Methods
Request Methods
| Method | Purpose | RFC |
|---|
INVITE | Initiate or modify a session | 3261 |
ACK | Confirm receipt of final INVITE response | 3261 |
BYE | Terminate an established session | 3261 |
CANCEL | Cancel a pending INVITE | 3261 |
OPTIONS | Query server capabilities | 3261 |
REGISTER | Register location with registrar | 3261 |
SUBSCRIBE | Request event notifications | 6665 |
NOTIFY | Send event notifications | 6665 |
REFER | Request call transfer | 3515 |
MESSAGE | Send instant messages | 3428 |
UPDATE | Modify session without dialog state change | 3311 |
PUBLISH | Publish event state to server | 3903 |
Response Code Categories
| Category | Range | Meaning |
|---|
| 1xx | 100-199 | Provisional (request received, processing) |
| 2xx | 200-299 | Success (request fulfilled) |
| 3xx | 300-399 | Redirection (further action required) |
| 4xx | 400-499 | Client Error (bad syntax or cannot fulfill) |
| 5xx | 500-599 | Server Error (server failed valid request) |
| 6xx | 600-699 | Global Failure (cannot fulfill anywhere) |
Common Response Codes
100 Trying - Request received, processing
180 Ringing - Callee being alerted
183 Session Progress - Call progress information
200 OK - Request successful
301 Moved Permanently - Resource has new URI
302 Moved Temporarily - Resource temporarily at different URI
400 Bad Request - Malformed request
401 Unauthorized - Authentication required
403 Forbidden - Server refuses request
404 Not Found - Resource not found
408 Request Timeout - No complete request in time
486 Busy Here - Callee is busy
500 Internal Server Error - Server processing error
503 Service Unavailable - Server overloaded/maintenance
600 Busy Everywhere - All destinations busy
603 Decline - Callee refuses to participate
SIP Message Structure
Request Format
METHOD sip:uri SIP/2.0
Via: SIP/2.0/UDP/TCP/TLS host:port;branch=z9hG4bK...
Max-Forwards: 70
From: <sip:user@domain>;tag=...
To: <sip:user@domain>
Call-ID: unique-id@host
CSeq: sequence METHOD
Contact: <sip:user@host:port>
[Optional headers...]
Content-Type: application/sdp
Content-Length: bytes
[SDP body for INVITE/ACK]
Response Format
SIP/2.0 CODE REASON-PHRASE
Via: SIP/2.0/UDP/TCP/TLS host:port;branch=z9hG4bK...
From: <sip:user@domain>;tag=...
To: <sip:user@domain>;tag=...
Call-ID: unique-id@host
CSeq: sequence METHOD
[Optional headers...]
Content-Length: bytes
[Body if applicable]
Key Headers Explained
| Header | Purpose |
|---|
Via | Transport protocol, client address, branch for loop detection |
Max-Forwards | Limits proxy forwarding (prevents infinite loops) |
From | Sender identity with optional tag |
To | Recipient identity with optional tag |
Call-ID | Unique session identifier |
CSeq | Sequence number + method (matches requests/responses) |
Contact | Direct route to user agent |
WWW-Authenticate | Digest auth challenge (realm, nonce, algorithm) |
Authorization | Digest auth credentials |
Content-Type | Body media type (usually application/sdp) |
Content-Length | Body size in bytes |
Creating SIP Messages
Generate a SIP INVITE
Use the scripts/generate_sip_invite.py script to create properly formatted INVITE messages:
python scripts/generate_sip_invite.py \
--from "sip:caller@example.com" \
--to "sip:callee@target.com" \
--contact "sip:caller@192.168.1.100:5060" \
--transport UDP \
--output invite.txt
Generate a SIP REGISTER
python scripts/generate_sip_register.py \
--username alice \
--realm example.com \
--contact "sip:alice@192.168.1.100:5060" \
--expires 3600 \
--output register.txt
Calculate Digest Authentication Response
When you receive a 401 Unauthorized with WWW-Authenticate header, use the script to calculate the response:
python scripts/calculate_sip_digest.py \
--username alice \
--password "secretpassword" \
--realm "example.com" \
--method REGISTER \
--uri "sip:example.com" \
--nonce "abc123nonce" \
--cnonce "xyz789cnonce" \
--nc 00000001 \
--qop auth
This outputs the MD5 response value for the Authorization header.
SIP Security Assessment
Fingerprinting and Discovery
Send OPTIONS requests to enumerate capabilities:
sudo nmap -sU -p 5060 --script sip-methods <target>
printf "OPTIONS sip:<target> SIP/2.0\r\nVia: SIP/2.0/UDP attacker;branch=z9\r\nFrom: <sip:probe@attacker>;tag=1\r\nTo: <sip:probe@<target>>\r\nCall-ID: 1@attacker\r\nCSeq: 1 OPTIONS\r\nMax-Forwards: 70\r\nContact: <sip:probe@attacker>\r\nContent-Length: 0\r\n\r\n" | nc -u -w 2 <target> 5060
Review Allow, Supported, Server, and User-Agent headers to identify:
- PBX type and version (Asterisk, FreeSWITCH, 3CX, etc.)
- Supported methods (MESSAGE, PUBLISH, REFER)
- Potential vulnerabilities based on version
Username/Extension Enumeration
SIP servers often leak valid extensions through response differences:
| Response | Meaning |
|---|
401/407 | Valid user, auth required |
404 | User not found |
403 | User exists but forbidden |
486 | User exists but busy |
Test approach: Send REGISTER or INVITE to various extensions and compare responses. Uniform responses indicate proper hardening.
Digest Authentication Cracking
SIP commonly uses HTTP-Digest authentication. Extract from pcap:
username:realm:method:uri:nonce:cnonce:nc:qop:response
Crack with hashcat (mode 11400 for MD5):
echo 'alice:example.com:REGISTER:sip:example.com:abcdef:11223344:00000001:auth:65a8e2285879283831b664bd8b7f14d4' > sip.hash
hashcat -a 0 -m 11400 sip.hash /path/to/wordlist.txt
Note: RFC 8760 defines SHA-256 and SHA-512/256 for modern deployments. Check if your tools support these.
Common Vulnerabilities to Check
- Weak digest algorithms - MD5 is trivial to crack offline
- Missing authentication - Anonymous registration/calling enabled
- Extension enumeration - Response differences leak valid users
- TLS misconfiguration - Self-signed certs, weak ciphers, no validation
- Information disclosure - OPTIONS reveals version, methods, capabilities
- DoS susceptibility - No rate limiting on INVITE/REGISTER
- CVE-2024-35190 - Asterisk PJSIP endpoint misidentification (affects 18.x < 18.23.1, 20.x < 20.8.1, 21.x < 21.3.1)
Hardening Recommendations
Server Configuration
Asterisk chan_sip:
[general]
alwaysauthreject=yes
allowguest=no
port=5060
bindaddr=0.0.0.0
[endpoint]
permit=10.0.0.0/8
deny=0.0.0.0/0
Asterisk PJSIP:
[general]
[endpoint]
acl=trusted_networks
media_acl=trusted_networks
Network-Level Protection
iptables -A INPUT -p udp --dport 5060 -m hashlimit \
--hashlimit-name SIP --hashlimit 20/second --hashlimit-burst 40 \
--hashlimit-mode srcip -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j DROP
Best Practices Checklist
Troubleshooting Common Issues
Call Setup Fails
- Check SIP logs on both endpoints
- Verify NAT traversal (STUN, TURN, or ALG)
- Confirm firewall allows UDP 5060 and RTP ports (10000-20000 typical)
- Validate SDP negotiation (codecs, ports)
- Check for 407 Proxy Authentication vs 401 Unauthorized
Registration Fails
- Verify credentials match server configuration
- Check registration expiration (default 3600 seconds)
- Confirm network connectivity to registrar
- Review 401 challenge parameters (realm, nonce)
- Ensure Contact header matches expected format
One-Way Audio
- Verify NAT configuration (rtp_symmetric, directmedia)
- Check firewall for RTP port range
- Confirm SDP IP addresses are routable
- Test with direct IP vs SIP URI
References
Scripts Available
| Script | Purpose |
|---|
generate_sip_invite.py | Create INVITE messages with SDP |
generate_sip_register.py | Create REGISTER messages |
calculate_sip_digest.py | Calculate digest auth response |
parse_sip_message.py | Parse and display SIP message structure |
sip_options_probe.py | Send OPTIONS for fingerprinting |
Run python scripts/<script>.py --help for usage details.
