Capturing VoIP calls with Wireshark

VoIP phones are implemented in large organizations and they are providing a striking surface for each malicious user to know the basics of hacking. If there is no encryption in the media, then an attacker could intercept telephone conversations that may affect the business in the event that the calls are classified as confidential.

A pentester must be able to identify whether it is possible to listen to the voice network using the following technique.

ARP Poisoning

The first step before implementing a Man??-in-the-Middle attack is to allow the routing of packets

Quote:echo 1> / proc/sys/net/ipv4/ip_forward

Now you can run a Man??-in-the-middle attack, in order to be able to intercept VoIP traffic This can be achieved very simply with the command below.:


Capture and decoding VoIP traffic

Now that traffic is being routed to your computer, you can use Wireshark to capture all SIP traffic. We are particularly interested in RTP packets as they contain the actual conversation in a VoIP call.

Wireshark contains an embedded utility called VoIP, which can decode RTP data into a format playable audio.


Conclusion

As we have seen, is very easy and quick to listen to a phone conversation just by performing a MITM attack and have a tool like Wireshark to capture traffic. On ratings VoIP, the pentesters should attempt to implement this attack in order to identify whether listening is possible. To avoid this type of attack must use SRTP, which is a secure protocol and provides encryption of data being transferred