Two Burp Suite extensions that group responses by content: Response Overview, a BApp with a threshold you set, and Colonel Clustered, which picks its own.

Welcome back, aspiring cyberwarriors! 

If you’ve worked in an office, you’ve seen those phones on every desk. Some are wireless with a station, others look like regular landline phones. SIP is the language office phones use to sign in and start a call over the network. A phone call over the internet has two parts. First the two sides have to find each other and agree to talk, then the actual voice moves. SIP only handles the first part. The voices themselves travel on a separate path. That’s how most VoIP systems set up calls.

That’s why a stolen SIP password can be an issue. They are stealing the system’s belief that they are that desk phone. Once the handshake accepts them as an extension, say 1000, the phone system treats their laptop like that employee’s handset. They can place calls as other people and in many setups receive their incoming calls too.

Today we’re going to use SIPVicious against SIP and show you how it can be compromised.

Asterisk 

Asterisk is a program that understands SIP and runs the office switchboard. It decides who can sign in, what numbers exist, and who can call whom. It’s one of the most popular programs for SIP.

We set it up in our lab with Docker.

SIPVicious

Next thing we need to have installed is SIPVicious. The installation is pretty simple.

ubuntu > python3 -m venv sipvicious
ubuntu > source sipvicious/bin/activate
ubuntu > pip3 install sipvicious

The tool comes with 5 different commands: svmap, svwar, svcrack, svreport, svcrash.

Each of these commands has a help menu

ubuntu > sipvicious_svmap -h

We’ll use the first three commands for our test. The rest aren’t really important.

Identification

Using svmap we can find out what service the target is running.

ubuntu > sipvicious_svmap 127.0.0.1

Sometimes the results vary depending on whether you provide the extension. The extension is the phone’s account number.

ubuntu > sipvicious_svmap 127.0.0.1 -e 1000

You can look up the version and check whether it’s vulnerable to known exploits

Finding Account Numbers

Extensions are account numbers. They usually start at 1000. Old software will allow enumeration, but modern software ignores your requests, so you won’t be able to find out which accounts exist.

Still, it’s worth trying.

ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010

You can also try –force and see what comes back. You’ll most likely see 401 Unauthorized, but that can vary depending on the software you’re testing.

ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010 --force

Cracking Passwords

Even if we can look up extensions, we’ll start by trying common ones with our own credentials list. Let’s create a wordlist first.

# creating the list of credentials

ubuntu > printf ‘%s\n’ 1000 1001 admin password asterisk mrsip-lab > sip-pass.txt

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 -d sip-pass.txt

mr-siplab was indeed our password for three of those accounts. This let’s take a look at two other ways of getting credentials without a wordlist. 

One option is to test the passwords the tool ships with. The default password set is a numeric range from 100 to 999

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000

You can also try the –enabledefaults flag. It adds common passwords, including the extension number itself.

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 --enabledefauls

This didn’t work in our case, because the password was not predictable. 

We did have three contacts in our Asterisk setup though, and the tool successfully compromised all of them.

What Can Hackers Do

One of the biggest risks is toll fraud. Hackers can use compromised extension credentials to register to the system and place expensive international calls. That’s still the most common attack. Hackers can use compromised accounts to run vishing campaigns against other companies. If hackers are already inside and have the phonebook, they can convince employees and support teams to reset passwords, for example.

Summary

Modern software blocks enumeration of existing users, but it’s still possible given how much outdated software is out there. SIPVicious can identify the software in use and test common extensions for weak passwords. There are a few password attacks it can run with or without a wordlist. Sometimes knowing the version alone is enough to compromise a server and get into the network. Don’t overlook yours and regularly upgrade things.

The post Offensive Security: Pentesting Office Phones with SIPVicious first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

These days, most of our online activity happens in web browsers. They’re our main way to access the internet, but they can also make it easy for malware to slip into our systems. While there are known vulnerabilities in browsers, the real trouble often comes from malicious browser extensions.

So, in this article, we’ll take a look at a tool called ExtAnalysis that acts as a first line of defense against sketchy plugins. It helps you do some forensic research and static code analysis quickly and visually. Let’s get rolling!

Getting Started with ExtAnalysis

ExtAnalysis is an open-source security framework designed to scan, analyze, and extract threat intelligence from Chrome, Firefox, Edge, and Brave extensions. It runs locally as a web application powered by a Flask backend.

To install it, we need to clone the repository from GitHub and run the main Python script:

kali> git clone https://github.com/Tuhinshubhra/ExtAnalysis
kali> cd ExtAnalysis
kali> pip3 install -r requirements.txt --break-system-packages
kali> python3 extanalysis.py

By default, ExtAnalysis binds to 127.0.0.1 on port 13337 and automatically opens a browser window to http://127.0.0.1:13337.

ExtAnalysis supports different formats. First of all, we can just provide a link to the plugin published on the Chrome Web Store or Firefox Add-ons. Secondly, it supports local extension scanning. And lastly, we can manually upload unpacked or packed extension archives in .crx, .xpi, .zip, and .tar formats. For this demonstration, I’ll just provide a link to a random crypto wallet published in the Chrome Web Store.

After entering the URL, ExtAnalysis will start analysis. Depending on the size of the plugin, it can take time. Eventually, you will see the report as below.

On the basic info tab, we can see data like name, author, version, extracted URLs, etc. Also, this tab has a built-in viewer for reviewing manifest.json configuration blueprints.

By changing the tab to Files, we can explore an interactive network graph. It constructs an interactive network graph mapping all extension source files, internal scripts, outbound external URLs, and domain relationships.

As you can see at the bottom of the screenshot, ExtAnalysis also allows viewing the source code of the files. It features an embedded tool to de-minify and restructure obfuscated or dense JavaScript and CSS files for manual code audits.

Next, we have the permission risk assessment tab.

ExtAnalysis parses requested permissions and categorizes them into risk levels (High, Medium, etc) to highlight capability escalation.

After that, we have the URL Reconnaissance Suite tab.

This tab provides extracted domains, URLs, and external JS files. For full functionality, navigate to the settings menu inside the web interface and enter your VirusTotal API key to enable automated hash and domain scans.

And last but not least is the tab with extracted intelligence.

ExtAnalysis automatically scans all extension files to parse and extract hardcoded threat indicators, including IPv4 and IPv6 addresses, domains, full URLs, Bitcoin wallet addresses, and email addresses. It also detects Base64-encoded strings and raw file comments.

Workflow for Analyzing an Extension

Start by submitting the target extension for analysis. Next, review its manifest file and requested permissions to identify any overreach or suspicious capabilities. Then, inspect the interactive visual graph to map external domains, C2 infrastructure, and suspicious third‑party endpoints. After that, extract intelligence and IOCs by checking the dedicated tabs for hardcoded IP addresses, Base64 strings, Bitcoin wallet addresses, and other indicators of compromise. Finally, perform a code audit by opening JavaScript files in the built‑in viewer, applying the code beautifier, and inspecting background scripts for keyloggers, credential‑harvesting triggers, or other malicious logic.

Important Limitations to Keep in Mind

ExtAnalysis performs static analysis only, scanning extension source files without capturing runtime execution or behavior triggered dynamically. Heavily obfuscated JavaScript or sandbox‑evasion scripts can obscure its automated analysis, reducing visibility into malicious logic. For this reason, security researchers typically use ExtAnalysis as a fast first‑step reconnaissance tool to map structure and permissions before proceeding to dynamic analysis.

Summary

Web browser plugins make our lives easier, but if plugin developers have malicious intent, they can introduce significant security risks. In this article, we explored static analysis of extensions using the ExtAnalysis tool. Always pay attention to what you install, and stay secure.

The post Browser Forensics: Analyzing Suspicious Extensions with ExtAnalysis first appeared on Hackers Arise.