VoIP Hopper is a Unix/Linux based free opensource security tool that rapidly runs a VLAN Hop into the Voice VLAN on specific Ethernet switches. VoIP Hopper mimicks the behavior of an IP Phone, in both Cisco and Avaya IP Phone environments to hope into the Voice VLAN. VoIP Hopper is both a VLAN Hop test tool and a tool to test VoIP infrastructure security.
In Cisco IP Phone networks, it first dissects either IEEE 802.3 or Ethernet II for Cisco Discovery Protocol (CDP) packets. If CDP is enabled on the switch port and the Voice VLAN feature is enabled, it will determine the Voice VLAN ID (VVID). This will allow the tool to create a new Ethernet interface on the PC that tags the 802.1q VLAN header in the Ethernet packet. After VoIP Hopper has created the new Ethernet device, it will send a DHCP client request. It can also generate CDP messages just as an IP Phone based on CDP would do. It will send two CDP packets, requesting the Voice VLAN ID. After creating the new interface, it will then iterate between sleeping for 60 seconds, and sending a CDP packet.
In Avaya IP Phone environments, it sends an Option 55 parameter request list, requesting Option 176. When the DHCP server sends Option 176, it decodes the L2QVLAN reply field for the Voice VLAN ID. It then creates a new voice interface and sends a DHCP request.
VOIP Hopper can be downloaded from here
VOIP Hopper requires
libpcap – For Sniffing
GNU C Compiler & Make utility to install
To install
Unzip & Untar VOIP Hopper
debian# tar -zxvf voiphopper-0.9.9.tar.gz
Change Directory and Install
debian# cd voiphopper-0.9.9
debian:~/voiphopper-0.9.9# make
This installs VoIP Hopper on your Linux distribution.
Now, some of the usage examples are
Sniff CDP & VoIP Hop
debian# voiphopper -i eth1 -c 0
where "eth1" is the interface
-c = 0 – Defines sniffing
Spoof CDP & VoIP Hop in Cisco SIP environment
debian# voiphopper -i eth1 -c 1 -E 'SIP00070EEA5086' -P 'Port 1' -C Host -L 'Cisco IP Phone 7940' -S 'P003-08-8-00' -U 1
Spoof CDP & VoIP HOP in Cisco SCCP environment
debian# voiphopper -i eth1 -c 1 -E 'SEP0070EEA5086' -P 'Port 1' -C Host -L 'Cisco IP Phone 7940' -S 'P00308000700' -U 1
VLAN Hop without CDP Sniffing (if VLAN ID is known)
debian# voiphopper -i eth1 -v 200
Discover Voice VLAN in Avaya IP Phone environment
debian# voiphopper -i eth1 -a
Spoof MAC Address of an IP Phone by sniffing for CDP
debian# voiphopper -i eth1 -c 0 -m AA:AA:AA:AA:AA:AA
Spoof MAC Address of an IP Phone using Avaya DHCP request
debian# voiphopper -i eth1 -a -m AA:AA:AA:AA:AA:AA
Spoof MAC Address of an IP Phone by VLAN Hopping without CDP or DHCP
debian# voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA
Spoof MAC Address of IP Phone without changing the MAC Address of default ethernet interface
debian# voiphopper -i eth1 -v 200 -m AA:AA:AA:AA:AA:AA -D
Leave a Reply