Mr.SIP is a console-based SIP security assessment framework that scans VoIP networks, enumerates users, and simulates TDoS conditions for authorized penetration testers.
| Tool | meliht/Mr.SIP — console-based SIP audit, attack and traffic-generation framework in Python |
| Category | VoIP / SIP penetration testing framework |
| Primary Use | Detecting SIP components with SIP-NES, enumerating valid SIP users with SIP-ENUM, and simulating TDoS load with SIP-DAS during authorized engagements |
| Safe Use | Use only against VoIP lab environments (Docker PJSIP, Asterisk/Trixbox VMs) or production PBX systems you are explicitly authorized to assess |
| Telemetry Note | Generates distinctive SIP message traffic (OPTIONS, INVITE, REGISTER floods) and spoofed-source packets that SIP-aware IDS/IPS and PBX logs readily surface; scan probes expose manufacturer/version fingerprinting requests |
Mr.SIP occupies an unusual niche in the offensive tooling landscape: it is one of the few open-source frameworks that grew directly out of peer-reviewed academic research rather than hacker convenience. The README explains that it originated as an academic project investigating novel SIP-based DDoS attacks and matured into a fully functional SIP penetration testing tool, subsequently cited in journals including IEEE Access, Applied Sciences, and Computers & Security. With roughly 431 stars, a GPL-3.0 license, and a pure Python codebase, it is also unusually well-governed for its category — the repository ships a real test suite (262 network-free pytest tests), ruff linting in CI, structured documentation under docs/, and a CHANGELOG.md that records the technical rationale behind each change. That engineering discipline matters for an assessment tool, because auditors need confidence that what the tool sends on the wire matches what the documentation claims.
The public repository ships three modules, each addressed through a single entry point, mr.sip.py. SIP-NES is the network scanner: it discovers live SIP components on a target network and fingerprints them by manufacturer, product, and version — the reconnaissance phase of any VoIP engagement. SIP-ENUM takes the next logical step and identifies valid SIP users along with their authentication requirements, which is where extension harvesting and digest-challenge probing typically begin. SIP-DAS is the third module, a TDoS (telephony denial-of-service) attack simulator with an integrated IP-spoofing engine, intended for load and resilience testing against systems you are explicitly authorized to test. The README notes that all three share high-performance multithreading, IP spoofing, and what it calls smart SIP message generation.
Invocation follows a consistent grammar. python3 mr.sip.py --nes --tn=<target_IP> --mt=options --from=<ext> --to=<ext> runs a scan using OPTIONS as the message type; --enum mode drives user enumeration from a wordlist file; and --das mode simulates INVITE-based load with a controllable count and optional spoofing inputs via -r, -s, or -m --il=<file>. The usage guide documents each --mt message type individually, plus the --if, --pps, and --mtu flags in depth, and recommends ngrep for observing the traffic the tool emits — a good sign that the author expects operators to verify their own packets rather than trust the tool blindly.
A notable structural point is the split between the public edition and Mr.SIP Pro. The commercial product adds ten modules across three categories (Information Gathering, Vulnerability Scanning, Offensive), helper components, and a web GUI, whereas the GitHub repository deliberately limits itself to the three console modules described above. This is not crippleware in the usual sense — the public modules are functional and actively maintained — but professionals evaluating the tool for a full VoIP engagement should read docs/mrsip-pro.md first to understand exactly where the public version's coverage ends. Topics like digest-authentication cracking and CVE scanning appear in the repository's topic tags and the Pro marketing, not in the public module table.
The documentation set deserves specific praise because it addresses the part most attack tools ignore: building a legitimate target. docs/lab-guide.md walks through constructing a local test environment using Docker with PJSIP and a VM-based lab around classic chan_sip/Trixbox, and explains how to generalize the setup to other Asterisk-based PBXs. docs/installation.md covers Linux/macOS differences, virtual environment setup, and — critically — when root privileges are actually required, which for a raw-packet tool with spoofing capability is a real operational question. Anyone intending to evaluate SIP-DAS should start in exactly these labs, against infrastructure they own.
Defensively, the tool's own footprint is instructive. SIP-NES fingerprinting necessarily emits probe requests that betray version-discovery intent, and SIP-ENUM behavior — repeated registration or invitation attempts against candidate extensions — is precisely the pattern that rate-based anomaly detection on a Session Border Controller should flag. The SIP-DAS simulator's TDoS traffic, particularly when combined with IP spoofing, produces the asymmetric flood signatures described in the author's own DRDoS research. Blue teams running VoIP infrastructure can legitimately use Mr.SIP in a lab replica of their production PBX to validate that their detection thresholds actually fire before an adversary tests them for free.
The research lineage is more than decoration; it explains the tool's design priorities. The cited publications cover SIP-based DRDoS reflection attacks and mitigation strategies, blockchain-based caller-ID authentication (BBCA), INVITE and REGISTER abuse techniques, and SIP registration-erasure attacks targeting call-center environments. Each of these corresponds to an attack class the tool can model, and each has a matching defensive literature. For a practitioner, this makes Mr.SIP as much a reproducible research instrument as an offensive utility — the 2016 Computers & Security paper and its successors describe attack mechanics that can be validated in a lab with the same codebase that a pentester would carry into an engagement.
The conference track record is unusually deep for a SIP tool: repeated Black Hat Arsenal slots across USA, EU, and Asia from 2019 through 2023, a DEF CON 28 main-stage talk on practical VoIP penetration testing with Mr.SIP Pro, OffZone 2019 in Moscow, Black Hat MEA 2022 in Riyadh, and a Securi-Tay 2023 keynote. The project also claims practical deployment history, including Caller-ID spoofing tests in 2015 as part of a Turkish Standards Institute (TSE) collaboration related to national VoIP security strategy. None of this is a substitute for technical evaluation, but it does indicate sustained scrutiny from the assessment community over nearly a decade.
Where does this fit in an authorized workflow? Mr.SIP is best positioned as the VoIP layer of a broader telephony assessment: SIP-NES for discovery and fingerprinting of PBXs, proxies, and phones on an in-scope subnet; SIP-ENUM to convert discovered infrastructure into a validated user/extension inventory that feeds credential testing; and SIP-DAS, strictly lab-bound or contractually authorized, to measure how the PBX and its SBC degrade under call-flood conditions. Its ability to act as a SIP client simulator and traffic generator also gives it a benign role in capacity planning and interoperability testing that has nothing to do with attacking anyone.
Caveats worth weighing: the console-only public version means reporting, session management, and the more advanced offensive modules live behind the commercial Mr.SIP Pro product at mrsip.pro, which changes the calculus for teams hoping for a fully open toolchain. And because the framework includes genuinely disruptive capabilities — spoofed-source TDoS simulation is not a toy — the authorization boundary matters more here than with a typical web scanner. Run it against lab PBXs, or production VoIP under explicit written scope, and it is a well-engineered, academically grounded asset; run it anywhere else and it is exactly the kind of traffic that lands in an abuse report. The tool's own documentation, from the lab guide to the ngrep workflow, makes clear that its intended habitat is the controlled environment, and that is where it should stay.
meliht/Mr.SIP.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.