VoIP & Telephony Penetration Testing

We map the voice infrastructure: SIP servers, trunks, media gateways, desk phones and softphones, and any management or provisioning interface exposed on the network. Using SIPVicious-style enumeration and manual SIP probing we discover valid extensions, identify the PBX platform and version, and flag services that answer to anyone who asks.

Here we attack the parts that cost money. We test SIP registration for weak or default credentials, attempt to register as an existing extension and hijack it, and probe the dial plan for ways to place unauthorised outbound calls. Toll fraud is the headline risk, so we specifically look for routes that let an unauthenticated or low-privilege caller reach international and premium-rate numbers through your trunks.

Where signalling and media are not encrypted, we demonstrate the impact: capturing RTP streams from a call and reconstructing the audio, spoofing caller ID to impersonate an internal extension, and injecting or tampering with signalling. Seeing a recorded test call played back tends to make the case for SRTP and TLS more effectively than any advice.

We assess how the system holds up under registration floods and malformed SIP messages that can crash or overwhelm a PBX and drop live calls. Anything disruptive is agreed and scheduled with you first. You then get the written report within days, with reproduction steps and the exact configuration changes to make, a live walkthrough, and a free retest after you remediate.

Extensions protected by short numeric passwords, passwords equal to the extension number, or vendor defaults are trivially brute-forced. Once an attacker registers as a valid extension, they can place calls on your account and impersonate a member of staff.

Permissive routing rules let a compromised or unauthenticated endpoint dial out through your trunks to expensive destinations. This is the flaw that produces a five-figure phone bill over a weekend, and it is almost always a configuration issue rather than a software vulnerability, which means it is entirely preventable once you know where it is.

When SIP runs in plain UDP and media in plain RTP, anyone with a foothold on the network can record calls and read call metadata. For any business that discusses money, health or personal data by phone, that is a confidentiality breach waiting to happen. We show whether TLS and SRTP are in force and where they quietly are not.

Weak authentication on SIP registration lets an attacker take over an extension or spoof the caller ID of an internal number, a powerful tool for vishing and social engineering against your own staff or customers. We test how easily an endpoint can claim to be someone it is not.

Management interfaces for Asterisk, FreePBX or 3CX reachable from the internet, running old versions with known vulnerabilities, are a direct path to full control of the phone system. We identify exposed and unpatched platforms and test the admin surface for authentication and injection flaws that would hand over the entire system.

The features around the phones matter too. Voicemail protected by a default or four-digit PIN can be raided for sensitive messages, IVR menus sometimes expose a hidden path to an outside line, and auto-provisioning servers that hand out phone configurations without authentication leak credentials and SIP settings to anyone who asks. We test these secondary surfaces because attackers use them as the quiet way in when the front door is locked.

SIP services are easy to flood, and a registration or INVITE storm can drop every call in the building. For a contact centre or any business where the phone is the front door, an outage during peak hours is a direct revenue loss, so we assess how resilient the system is and where rate limiting is missing before an attacker tests it for you at the worst possible moment.

If your agents take card payments by phone, the call path is in scope for PCI DSS, and requirement 11.4 calls for regular penetration testing of the connected systems. Where calls are recorded, PCI DSS requires that card data is not stored in recordings, so pause-and-resume and DTMF-masking controls are tested as part of the engagement.

Call recordings and voicemail are personal data under GDPR, so we test how they are stored, who can reach them, and whether they cross the network in the clear. The findings support ISO 27001 controls on communications security and access control, and we structure the report so it slots into your audit evidence.