# sip_server_sim.py - SIP server that accepts replayed authenticated requests
from flask import Flask, request
app = Flask(__name__)
# Simulated nonce storage: doesn't track used nonces
used_nonces = set()
@app.route('/call', methods=['POST'])
def call():
auth_header = request.headers.get('Authorization')
if not auth_header:
return 'Unauthorized', 401, {'WWW-Authenticate': 'Digest realm="test", nonce="abc123"'}
# Vulnerability: no replay protection; accepts the same nonce repeatedly
# In real SIP, a nonce should be used once; here we skip that check.
return "Call connected"
if __name__ == '__main__':
app.run(port=5060)
SIP 服务器实现了摘要认证，但没有强制 nonce 的唯一性或过期时间。攻击者可以捕获单个有效的 Authorization 头并重放它来进行未经授权的呼叫，从而绕过认证。
pip install flask
python sip_server_sim.py
python exploit_sip_replay.py
重放的请求成功。