EnableSecurity/sipvicious: the VoIP audit toolset that walks a SIP estate from scan to credential test

Five tools that follow one path through a VoIP estate

SIPVicious OSS is a set of security tools for auditing SIP based VoIP systems, and the toolset is structured as a sequence rather than a collection. The stated job is to find SIP servers, enumerate SIP extensions and finally crack their password, and there are five tools that map onto that path.

`svmap` is a SIP scanner. Launched against ranges of IP address space it identifies any SIP servers it finds on the way, and it can also scan hosts on ranges of ports.

`svwar` identifies working extension lines on a PBX, where a working extension is one that can be registered, and it also tells you whether the extension line requires authentication or not.

`svcrack` is a password cracker that makes use of digest authentication, able to crack passwords on both registrar servers and proxy servers. Its current cracking modes are either numeric ranges or words from dictionary files.

`svreport` manages the sessions created by the rest of the tools and exports to pdf, xml, csv and plain text.

`svcrash` responds to svwar and svcrack SIP messages with a message that causes old versions to crash.

That last tool is where the ethical line sits, and it is worth naming plainly rather than burying. A tool whose purpose is to crash a server is a denial of service tool, and the project is explicit about the scope of use in the rest of the repository too, with a note to vendors and service providers pointing them at the professional penetration testing services offered by Enable Security. These are offensive tools. The value of the toolset is that it automates the boring parts of an authorised audit and produces a record of what it found.

scanning, enumeration and cracking are separate tools on purpose

The split into five commands is not a packaging convenience, it is how the audit is supposed to proceed.

Discovery comes first. `svmap` answers a narrow question, which SIP servers answer on this range of addresses and ports, and nothing about them is assumed until the next tool runs. A scan that also tried to authenticate would be noisier and would conflate two very different findings.

`svwar` then turns a list of hosts into a list of accounts. Its definition of a working extension is a registration that succeeds, and its extra value is the answer to a question a scanner cannot settle, which is whether that extension requires authentication. That single bit per extension is what tells an auditor where the interesting part of the estate is, because an extension that needs no credentials is a different finding from one that does.

`svcrack` is where authorisation matters most. It speaks digest authentication, which is the challenge and response scheme SIP uses, and it works against registrar servers and proxy servers, not just against the accounts themselves. The two cracking modes are numeric ranges and dictionary files, so the auditor chooses the shape of the search, and the number of attempts is bounded by the word list or the range rather than by an unbounded search.

`svreport` closes the loop. Because the other tools create sessions, the reporting tool exists to turn those sessions into an export in pdf, xml, csv or plain text, which is what you attach to a report and what an auditor can hand to whoever owns the PBX.

IPv6 targets are not uniform across the toolset

The IPv6 support is documented in enough detail to be useful, and the details differ per tool in a way that will cost you an afternoon if you assume otherwise.

`svwar` and `svcrack` accept `-6` with either a bare IPv6 literal such as `2001:db8::10` or a URI such as `udp://[2001:db8::10]:5060`.

`svmap` accepts `-6` with bare or bracketed IPv6 literals such as `2001:db8::10` or `[2001:db8::10]`, but it does not accept URI syntax for IPv6 targets. For that case, the port is chosen with `-p`, for example `sipvicious_svmap -6 -p 5060 [2001:db8::10]`.

So a URI target works for `svwar` and `svcrack` but not for `svmap`, where the destination port has to be given separately with `-p`.

For an estate that is dual stack, that is the detail to get right before the first scan, along with the general usage help, which the README says is available through the `-h` or `--help` switch.

Installation through pip gives you five console scripts

SIPVicious OSS requires Python 3.6 or newer, and installation is a single command run from the repository root:

python3 -m pip install .

That installs five console scripts, each namespaced under the project: `sipvicious_svmap`, `sipvicious_svwar`, `sipvicious_svcrack`, `sipvicious_svreport` and `sipvicious_svcrash`. The namespacing is worth noting, because these are the names you will use in scripts and in the documentation, and the bare `svmap` form is not what you type.

Further installation details, including the dependencies, are in the installation section of the wiki, and the GitHub wiki remains the primary home for the documentation. The README itself is deliberately short, pointing at the wiki, at a getting started page and at a vendor tutorial that walks through VoIP security testing with DVRTC.

The repository itself is laid out like a long lived Python project. There is a `setup.py` with the classic `find_packages` and `setup` call rather than a modern `pyproject.toml`, a `MANIFEST.in` for packaging data, a `sipvicious/` package directory, `man1/` for manual pages, an `autotest/` directory for the project's own tests, a `tests/` directory, `resources/`, and a `Changelog`, `TODO` and `THANKS` file.

For a tool that people are asked to run against other people's networks, the man pages and the wiki are the right place to look for the exact behaviour of a flag, and the `-h` output is there when you need it faster.

Licence, releases and who maintains it

The licence needs a careful reading, and the two sources do not describe the same thing.

The project is published with a `LICENSE` file in the tree that GitHub cannot classify as a standard licence. The packaging file describes the project as free software under the GNU General Public License, with the standard redistribution clause and a warranty disclaimer, and it declares `license='GPL-2.0-or-later'` in the setup call, with the copyright held by Sandro Gauci from 2007 to 2026. It also refuses to run on Python 2, raising an exception if the major version is below 3.

The practical answer is that the GPL notice in the source and the licence file in the repository are the two things to read, and where they seem to differ, the file in the repository is the operative document. Either way, a tool that cracks passwords and crashes servers carries obligations and exposure that a permissive licence would not change.

On maintenance, the last push to the repository was on 2026-07-10, and the release tags v0.3.6 and v0.3.7 were both published on 2026-04-10, with v0.3.8 following on 2026-07-10. So the project is being worked on and it is cutting releases, though the version numbering shows that this is a mature codebase rather than a new one.

The commercial context is stated plainly in the README. Vendors and service providers looking for professional VoIP and WebRTC penetration testing are pointed to Enable Security's own offerings, which is a reasonable signal that the free toolset is the entry point for practitioners and the commercial work is done by the same people.

Editorial conclusion

Adopt SIPVicious OSS when you are auditing a SIP based VoIP system you own or have written permission to test, and you want a single toolset that covers discovery, extension enumeration and digest authentication testing rather than assembling separate tools, with the session export in svreport giving you evidence afterwards. Do not adopt it for passive monitoring, for securing a PBX, or for anything that touches a third party's system without a signed authorisation, because these are attack tools and the liability is yours. Verify first that the SIP deployment you are pointed at is in scope, that your target's digest authentication is configured the way svcrack expects, and that you read the licence file in the repository, since the packaging metadata describes a GPL-2.0-or-later release while the repository licence is a custom file GitHub could not classify.

Frequently asked questions

Official sources

1. EnableSecurity/sipvicious on GitHub
2. Issues
3. Project website
4. README
5. Releases