VOIP-SIP-SCANDiscovery

SIP Scanning & Enumeration

svmap / sipvicious / nmap sip-enum-users — discover SIP servers and enumerate valid extensions via OPTIONS / REGISTER responses.

§ Where this technique fits

VOIP-SIP-SCAN is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

SIP extension brute → toll fraud / premium-rate exfil
Internet-exposed Asterisk / FreePBX with extensions whose password equals the extension number. Bruteforce a few, place expensive international / premium-rate calls.
step 1 / 5

§ What commonly comes next

01
SIP REGISTER Bruteforce
VOIP-SIP-BRUTE · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

SIP extension brute → toll fraud / premium-rate exfil

§ What commonly comes next