beelzebub

Beelzebub Deception Runtime Framework Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fideli...

POC

POC For research purposes only! A public collection of POCs & Exploits for the vulnerabilities I discovered. CVE-2022-22583 PackageKit : An application may be able to access restricted files SIP Bypass CVE-2022-26690 PackageKit : A malicious application may be able to modify protected parts of th...

bluebox

Bluebox work in progress A collection of exploits for different VoIP products. Thanks to the Go Exploit Framework. If you ended up here looking for a VoIP pentesting solution, check out Sippts sippts-gui in Kali or SIPVicious. This project is more focused on the exploitation phase. Install git...

sippts

What is Sippts? Sippts is a set of tools to audit VoIP servers and devices using the SIP protocol. Sippts is programmed in Python and it allows us to check the security of a VoIP server using the SIP protocol. Is it free? Yes. You can freely use, modify and distribute it. If you modify it, please...

cve-2022-27255

CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow This repository contains the materials for the talk "Exploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtek’s SDK for eCos OS.", which was presented at DEFCON30. The contents of...

resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

CVE-2026-110658

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

libsrtp

Introduction to libSRTP This package provides an implementation of the Secure Real-time Transport Protocol SRTP, the Universal Security Transform UST, and a supporting cryptographic kernel. The SRTP API is documented in include/srtp.h, and the library is in libsrtp2.a after compilation. This...

CVE-2026-110658 Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

CVE-2026-110658

Sofia-SIP versions through 1.13.18 are vulnerable to a heap out-of-bounds read in the msg_multipart_parse() function. An unauthenticated remote attacker can trigger this vulnerability by sending an INVITE request with a multipart Content-Type where the boundary exceeds the actual body length. Thi...

EUVD-2026-101131

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

asterisk

The AsteriskR Open Source PBX By Mark Spencer and the Asterisk.org developer community. Copyright C 2001-2025 Sangoma Technologies Corporation and other copyright holders. SECURITY It is imperative that you read and fully understand the contents of the security information document before you...

Mr.SIP

SIP Security, Attack and Audit Framework Mr.SIP is...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

mach_race

Mach Race OS X Local Privilege Escalation Exploit c fG! 2015, 2016, [email protected] - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit CVE-2016-1757. Usage against a SUID binary: ./machraceserver /bin/ps compatmode for i in seq 0 1000000; do...

Digital-Signature-Hijack

Digital Signature Hijack Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a...

CVE-2024-31964

CVE-2024-31964 CVE-2024-31964 PoC: Mitel 6900w Series SIP Phone - Temporary Authentication Bypass Vulnerability details Summary It consists of a temporary authentication bypass vulnerability in the HTTP administrative website panel of several Mitel Products. Impact Allows an attacker to modify th...

SigPloit

List of Contributors Rosalia D'Alessandro Ilario Dal Grande SigPloit SigPloit a signaling security testing framework dedicated to Telecom Security professionals and reasearchers to pentest and exploit vulnerabilites in the signaling protocols used in mobile operators regardless of the geneartion...

Mitel 6000 - OS Command Injection

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

viproy-voipkit

Discontinued Viproy was a PoC VoIP security assessment tool which had several modules and exploits to maintain. However, it was developed as a modules set to Metasploit Framework. As Metasploit Framework had significant updates, Viproy's current modules won't be able to work unless you use legacy...