A curated list of Real-time Communications (RTC) security resources focused on VoIP, WebRTC and VoLTE penetration testing, security research and vulnerability assessment.
- 2026-06: Add new tools (TURNado, TURNt, sipexer, twilio-security-scanner, H26Forge) and vulnerable labs (DVRTC, RTC_Attacks)
- 2024-12: Updated broken links and references
- 2024-12: Add new blogs
Your contributions are always welcome! Please read the contribution guidelines first:
- Check if the resource is still active/available
- Add a short description for tools and papers
- Include publication dates where applicable
- Keep descriptions concise and clear
- Sort entries alphabetically within sections
- Check your spelling and grammar
- Make sure your text editor is set to remove trailing whitespace
To the extent possible under law, the authors have waived all copyright and related rights to this work.
- Newsletters
- Presentation Slides
- Videos
- Advisories
- Open-source tools
- Papers
- Blogs
- Notable blog posts and articles
- Books
- Commercial tools
- Vulnerabilities
- Related lists
- Hacking VoIP Exposed from Black Hat USA 2006.
- Mobile network hacking – All-over-IP edition from SRLabs at Blackhat EU 2019
- Monitoring SIP Traffic Using Support Vector Machines
- OpenSSL DoS (CVE-2022-0778) versus WebRTC infrastructure
- TAD Summit EMEA Americas 2020: Getting offensive: a different approach to RTC security - Sandro Gauci
- HITBHaxpo D1: VoLTE Phreaking - Ralph Moonen
- Kamailio World 2019: The Various Ways Your RTC May Be Crushed - Sandro Gauci
- Kamailio World 2018: A tale of two RTC fuzzing approaches - Sandro Gauci
- Kamailio World 2017: Listening By Speaking - Security Attacks On Media Servers And RTP Relays - Sandro Gauci
- Kamailio World 2016: 9 Years Of Friendly Scanning And Vicious SIP - Sandro Gauci
- Kamailio World 2015: VoIP Security – Bluebox ng Continuous Pentesting - Sergio García Ramos
- Kamailio World 2013: VoIP Security Tools - Anton Roman
- Blackhat EU 2019: Mobile network hacking - All-over-IP edition - Karsten Nohl, Luca Melette & Sina Yazdanmehr
- Jailbreak Brewing Company Security Summit: Whatsup with WhatsApp: A Detailed Walk Through of Reverse Engineering CVE-2019-3568 - Maddie Stone
- RhurSec 2016: Eavesdropping on WebRTC Communication - Martin Johns
- Hak5 1813: SSL Hack Workarounds and WebRTC Flaws
- media.ccc.de: WebRTC Security - Stephan Thamm (language: german)
- Cisco IOS and IOS XE SIP Protocol Denial of Service Vulnerability
- Cisco IOS XE Software NAT SIP Application Layer Gateway Denial of Service Vulnerability
- Cisco TelePresence Video Communication Server SIP DoS Vulnerability
- Voice over LTE implementations contain multiple vulnerabilities
- Asterisk RTP Bleed
- Asterisk pjSIP CSeq Overflow
- Juniper Junos Router OS DoS
- Remote Access VPN and SIP Vulnerabilities in Cisco PIX and Cisco ASA
- Interaction SIP Proxy Buffer Overflow in SIPParser() Leads to DoS
- Asterisk pjSIP Multi Parser Out-of-Bound Memory Access
- Asterisk Skinny Memory Exhaustion
- Asterisk Stack Corruption in
subscribeMessage - Asterisk Segfault with Invalid SDP
fmtpAttribute - Asterisk Segfault with Invalid Media Format Descriptiom
- Asterisk Segfault with
INVITEReplay Attack - Kamalio Off-By-One Heap Overflow
- New RCS technology exposes most mobile users to hacking
- Zoom Communications user enumeration
- SIPVicious OSS - A set of tools to audit SIP based systems
- SIPPTS - Another set of tools to audit VoIP servers and devices using SIP protocol.
- bluebox-ng - Pentesting framework using Node.js powers, focused in VoIP. (public archive)
- SigPloit - Tool which covers all used SS7, GTP (3G), Diameter (4G) or even SIP protocols for IMS and VoLTE infrastructures.
- vsaudit - VoIP security assessment framework.
- rtpnatscan - Tool which tests for rtpbleed vulnerability.
- VIPROY - VoIP pentest framework which can be used with the metasploit-framework.
- SIP Proxy - A VoIP security testing tool.
- Metasploit auxiliary modules
- SIPp: SIP based test tool / traffic generator.
- Mr.SIP - SIP based audit and attack tool.
- VoIPShark - Open Source VoIP Analysis Platform
- Turner - PoC for tunnelling HTTP over a permissive/open TURN server.
- sipsak - SIP swiss army knife, has some features that can be used for security testing (e.g. flood more or random mode)
- sipexer - modern and flexible SIP command line client for testing SIP servers and devices, with custom requests, registration floods, stateful dialogues and lightweight fuzzing.
- turnproxy - Tool to abuse open TURN relays
- SeeYouCM Thief - download and parse configuration files from Cisco phone systems searching for SSH credentials
- stunner - a tool to test and exploit STUN, TURN and TURN over TCP servers.
- TURNado - TURN attack toolkit from SySS that automates internal IP disclosure, UDP relay forwarding to internal/loopback services, SOCKS proxying, layer-3 tunnelling and allocation-based DoS.
- TURNt - PoC from Praetorian that abuses TURN servers (e.g. Zoom and Teams) to tunnel command-and-control traffic over web-conferencing infrastructure (the "Ghost Calls" technique).
- VoIP Hopper - a tool to exploit insecure VLANs that are often found in IP Telephony infrastructure.
- twilio-security-scanner - scans Twilio Serverless deployments for misconfigurations such as public functions and assets, unencrypted webhooks and stale API keys.
- H26Forge - generates and fuzzes syntactically valid but spec-non-compliant H.264 video to find decoder vulnerabilities (relevant to WebRTC video attack surface).
- Abusing SIP Authentication
- Multiple Design Patterns for Voice over IP (VoIP) Security
- Realtime Steganography with RTP (local copy)
- A Lossless Steganography Technique for G.711 Telephony Speech
- CallRank: Combating SPIT Using Call Duration, SocialNetworks and Global Reputation
- Steganography of VoIP streams
- Steganalysis of compressed speech to detect covert VoIP channels
- Securing Voice over Internet Protocol
- Protecting SIP Proxy Servers from Ringing-based Denial-of-Service Attacks
- An ontology description for SIP security flaws
- Analysis of DDoS Attacks in Heterogeneous VoIP Networks: A Survey
- Network security systems to counter SIP-based denial-of-service attacks
- Multilayer Secured SIP Based VoIP Architecture
- Battling Against DDoS in SIP
- Billing Attacks on SIP-Based VoIP Systems
- Secure SIP: A Scalable Prevention Mechanism for DoS Attacks on SIP Based VoIP Systems
- An Analysis of Security Threats and Tools in SIP-Based VoIP Systems
- Fast Detection of Denial-of-ServiceAttacks on IP Telephony
- VoIP Security: Threat Analysis & Countermeasures (local copy)
- Voice Over IP - Security and SPIT
- Enable Security Blog - A blog about VoIP, WebRTC and real-time communications security by Enable Security
- Pepelux blog (Spanish)
- Kwancro - Thoughts, tips and tricks - Often covers SIP honeypot activity and related security topics
- Fred Posner's Blog - includes commentary on VoIP security topics
- Understanding DTLS Usage in VoIP Communications
- How we abused Slack's TURN servers to gain access to internal services
- Analyzing WhatsApp Calls with Wireshark, radare2 and Frida
- Adventures in Video Conferencing Part 1: The Wild World of WebRTC
- Adventures in Video Conferencing Part 2: Fun with FaceTime
- Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp
- Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp
- Adventures in Video Conferencing Part 5: Where Do We Go from Here?
- Exploiting CVE-2022-0778, a bug in OpenSSL vis-à-vis WebRTC platforms
- Analyzing two FreeSWITCH vulnerabilities – CVE-2021-41157 & CVE-2021-37624
- Abusing Microsoft Teams Direct Routing
- Kamailio’s exec module considered harmful
- Hacking Exposed Unified Communications & VoIP Security Secrets & Solutions, Second Edition 2nd Edition (published December 20, 2013)
- Hacking VoIP: Protocols, Attacks, and Countermeasures (published March 21, 2008)
- SIP Security (published April 27, 2009)
The following are generic or common vulnerabilities that are related to either signalling, media or infrastructure.
- DVRTC (Damn Vulnerable Real-Time Communications) - intentionally vulnerable VoIP/WebRTC lab (Kamailio, Asterisk, rtpengine, coturn) for hands-on RTC security training.
- RTC_Attacks - vulnerable RTC lab from University of Naples with CVE-anchored exploit scenarios (SIP MESSAGE spoofing, RTP Bleed, coturn ACL bypass and more).
- CSAW CTF Qualification Round 2020 / Tasks / WebRTC - CTF challenge featuring WebRTC (2020)