meliht/mr.sipSIP Security Assessment Framework for VoIP Pentesters. Presented at DEFCON, BlackHat & Offzone.
SIP Security, Attack and Audit Framework
Mr.SIP is a simple, console-based SIP audit and attack tool. It was originally developed for academic work on novel SIP-based DDoS attacks, and evolved into a fully functional SIP-based penetration testing tool. It has since been cited in several academic papers and journal articles, and can also be used as a SIP client simulator and traffic generator.
This public repository ships 3 modules — network scanning, user enumeration, and DoS attack simulation. Mr.SIP Pro extends this with more modules and a web GUI.
chan_sip/Trixbox) labs, generalizing to other Asterisk-based PBXs--mt message type actually does, --if/--pps/--mtu in depth, ngrep, debug mode, architecture/data-flow diagram| Module | Purpose |
|---|---|
| SIP-NES (Network Scanner) | Detects SIP components on a network, along with manufacturer/product/version information. |
| SIP-ENUM (Enumerator) | Identifies valid SIP users and their authentication requirements. |
| SIP-DAS (DoS Attack Simulator) |
Competitive features across all three: high-performance multithreading, IP spoofing, and smart SIP message generation.
This is the public, 3-module version — see what Mr.SIP Pro adds below.
Mr.SIP Pro is the most comprehensive attack-oriented VoIP product available — 10 modules across 3 categories (Information Gathering, Vulnerability Scanning, Offensive), plus IP spoofing/message-generation helper components and a GUI, versus this repo's 3 console-only modules.
→ Full Public vs. Pro comparison · mrsip.pro · Pricing · Request a demo
pip install -r requirements.txt
python3 mr.sip.py --help
python3 mr.sip.py --nes --tn=<target_IP> --mt=options --from=<ext> --to=<ext>
python3 mr.sip.py --enum --from=<wordlist_file> [--tn=<target_IP>]
python3 mr.sip.py --das --mt=invite -c <count> --tn=<target_IP> [-r|-s|-m --il=<file>]
See the Installation Guide for OS-specific setup and the Usage Guide for the full command/flag reference.
This repo has a real test suite and CI - see CHANGELOG.md for the full technical history of fixes and hardening work.
pip install -r tests/requirements-dev.txt
pytest # 262 tests, network-free, runs in a couple seconds
ruff check src/ tests/ mr.sip.py
Mr.SIP started as academic research into novel SIP-based DDoS attacks and grew into a tool presented at some of the industry's largest security conferences, cited across peer-reviewed literature, and recognized in national innovation competitions.
See presentation links and video demos on the Demo Page.
Mr.SIP's methodologies have been cited in leading SCI-indexed journals and international conference proceedings (4 papers listed below, each individually verified against its publisher). The Cisco Press reference and graduate-thesis citations below are the author's own reported claims — searched independently while writing this section, but no specific book title, thesis, institution, or date could be found publicly to cite alongside them, including on Mr.SIP Pro's own site; noted here rather than silently dropped, since the absence of a public citation isn't evidence the claim is false, just that it can't be independently confirmed from outside sources.
Mr.SIP's academic contributions include the following attack/defense concepts across the papers above:
Also used in Caller-ID spoofing tests as part of a Turkish Standards Institute (TSE) collaboration on national VoIP security strategy (2015), and shared on various popular forums and news sources including Black Hat's own homepage (verified: a real Black Hat Asia Arsenal feature article describing Mr.SIP directly).
Featured by Black Hat Arsenal Highlights and showcased at numerous global conferences — including Black Hat Arsenal and DEF CON main stage.
Mr.SIP Pro has earned recognition through innovation-driven challenges and national competitions — including awards for ideas, early prototypes, or research projects that contributed directly to its foundation and evolution.
🥇 1st Place (Gold) – 2nd Cybersecurity Capstone Projects Competition (55 applications, 17 finalists, 2020) — corrected from a previous "130+ projects" claim that didn't match the primary source; verified directly against the organizer's own results post, which names Ismail Melih Tas as the gold-medal winner
🥈 2nd Place – Netaş Innovation Challenge (2012)
🥇 1st Place – Netaş Innovation Challenge (2011)
(These two Netaş placements were searched for independently but couldn't be matched to a public primary source, unlike the 2020 competition above — an old, likely-internal corporate competition from 2011-2012 not being indexed publicly isn't unusual, so this is noted rather than treated as confirmed or removed.)
| Performs TDoS-based attacks, with a powerful IP-spoofing engine. |