Bluebox-ng

Pentesting framework using Node.js powers. Focused in VoIP.

DISCLAIMER: Pointing this tool at other people's servers is NOT legal in most countries.

• Auto VoIP/UC penetration test
• Report generation
• Performance
• RFC compliant
• SIP TLS and IPv6 support
• SIP over websockets (and WSS) support (RFC 7118)
• SHODAN, exploitsearch.net and Google Dorks
• SIP common security tools (scan, extension/password bruteforce, etc.)
• Authentication and extension brute-forcing through different types of SIP requests
• SIP Torture (RFC 4475) partial support
• SIP SQLi check
• SIP denial of service (DoS) testing
• Web management panels discovery
• DNS brute-force, zone transfer, etc.
• Other common protocols brute-force: Asterisk AMI, MySQL, MongoDB, SSH, (S)FTP, HTTP(S), TFTP, LDAP, SNMP
• Some common network tools: whois, ping (also TCP), traceroute, etc.
• Asterisk AMI post-explotation
• Dumb fuzzing
• Automatic exploit searching (Exploit DB, PacketStorm, Metasploit)
• Automatic vulnerability searching (CVE, OSVDB, NVD)
• Geolocation
• Command completion
• Cross-platform support

Install

• Install Node.js: https://nodejs.org/download

npm i -g bluebox-ng

Kali GNU/Linux

• curl -sL https://raw.githubusercontent.com/jesusprubio/bluebox-ng/master/artifacts/installScripts/kali2.sh | sudo bash -

Use

Console

To start the console client.

bluebox-ng

Programatically

To run it from other Node code.

const Bluebox = require('bluebox-ng');

const box = new Bluebox();

box.run('gather/network/geo', { rhost: '8.8.8.8' })
.then(res => {
  console.log('Result:');
  console.log(res);
})
.catch(err => {
  console.log('Error:');
  console.log(err);
});

Developer guide

• Use GitHub pull requests.

Environment

• Get a copy of the code and install the dependencies.

git clone https://github.com/jesusprubio/bluebox-ng
cd bluebox-ng
npm i # or use yarn

Debug

We use the visionmedia module, so you have to use this environment variable:

DEBUG=bluebox-ng* npm start

New modules

You can add your own features to this environment following this tips:

• Add a new file inside /modules and it should appear in the pentesting environment.
• Use the most similar among the actual ones as boilerplate.

Tests

We still don't have a proper Docker setup. So, for now, the test have to be run locally. Please check its code before it, they often need a valid target service.

./node_modules/.bin/tap test/wifi
node test/wifi/*
./node_modules/.bin/tap test/wifi/scanAps.js
node test/wifi/scanAps.js

Conventions

• We use ESLint and Airbnb style guide.
• Please run to be sure your code fits with it and the tests keep passing:

npm run posttest

Commit messages rules

• It should be formed by a one-line subject, followed by one line of white space. Followed by one or more descriptive paragraphs, each separated by one line of white space. All of them finished by a dot.
• If it fixes an issue, it should include a reference to the issue ID in the first line of the commit.
• It should provide enough information for a reviewer to understand the changes and their relation to the rest of the code.

Contributors

• https://github.com/jesusprubio/bluebox-ng/graphs/contributors

Thanks to

• Our mentors: @antonroman, @sandrogauci (SIPVicious was our inspiration), @pepeluxx, @markcollier46 ("Hacking VoIP Exposed").
• Quobis, some hours of work through personal projects program.
• Kamailio community (@kamailioproject), our favourite SIP Server.
• Tom Steele (@_tomsteele) and the rest of exploitsearch.net team.
• All developers who have written the Node.js modules used in the project.
• All VoIP, free software and security hackers that we read everyday.
• Our friend Carlos Pérez, the logo designer.