Recommended Free Tools
SIPVicious is an open-source toolkit for auditing SIP-based VoIP systems, including the PBX servers and IP desk phones that run many office phone networks. It can discover SIP services, check which extensions respond, test digest-authentication passwords, and export session reports. It is only appropriate against systems you have written permission to test, and some of its methods can make real phones ring or generate traffic that a production PBX will notice. This guide covers what each tool does, how to plan and run an authorized assessment, and how to read the results without overstating them.
What SIPVicious covers
SIPVicious is a suite of command-line tools, each aimed at one part of a SIP assessment. The project describes five components. The table below summarizes their documented roles and the cautions that matter most in an office environment.
As an Amazon Associate I earn from qualifying purchases.
| Tool | Documented role | Operational note |
|---|---|---|
svmap |
Identifies SIP devices and PBX servers across a host, a range, or a set of ports. | The default probe method is OPTIONS. INVITE is also supported, and the project’s guide warns that INVITE can make phones ring. |
svwar |
Identifies active extensions and whether a given extension requires authentication. | Output depends on the PBX’s responses and on the extension numbers you supply. |
svcrack |
Tests SIP digest-authentication passwords using numeric ranges or dictionary files. The project characterizes it as an online password cracker. | Only for accounts you are explicitly authorized to test. Repeated attempts against a live PBX are not a harmless check. |
svreport |
Manages tool sessions and exports reports in PDF, XML, CSV, and plain text. | PDF export depends on the optional ReportLab library, which the installation documentation treats as an optional dependency. |
svcrash |
Sends responses to certain svwar and svcrack traffic that the project describes as capable of crashing older tool versions. |
Its purpose signals potential service disruption. Do not use it on live systems that belong to someone else. |
Set authorization and scope before any packet leaves your machine
A SIP assessment touches live telephony, and telephony failures are visible to every employee on the floor. The project’s FAQ tells users to request permission before running the suite against a network. Treat that as the starting point, and put the following in writing before testing begins:
- The in-scope hosts, such as the PBX address, SIP trunk gateways, and phone subnets, with any out-of-scope ranges named explicitly.
- The methods you are allowed to use. If INVITE probing is off the table, say so, because it can ring phones.
- Whether password testing is permitted at all, and if so, which test accounts and what limits apply to failed attempts.
- A test window that avoids peak call hours, paging events, and change freezes.
- An emergency contact on the client side who can stop the test and confirm whether phones or call routing have been affected.
Build a controlled lab first
Practicing in a lab lets you learn each tool’s output without risking a production phone system. A lab does not need a physical phone to run the software, but a SIP endpoint can help you see how a real handset reacts to a probe. The project documentation does not name a required phone model, so any SIP-capable device you own will serve for practice.
#1 Best Overall
- Make more natural and life-like calls with Polycom HD Voice
- 2. 8” color display: an engaging experience offering visual information at a glance
- Two Gigabit Ethernet ports offer cost savings and performance benefits
- USB port enables users to move data around more quickly
- Integrates with more than 60 industry leading call control platforms
- Confirm that the machine runs Python 3. The SIPVicious wiki’s Basics page lists Python 3 as the requirement and documents the tested operating systems and installation options.
- Install SIPVicious from the project’s official instructions, not from a third-party mirror, and record the exact version or commit you used.
- Install the optional ReportLab library only if you need PDF output from
svreport. - Run each tool’s built-in help to confirm the flags available in your installed version before you rely on any example from a guide.
- Stand up a test PBX, such as an Asterisk instance you control, and create a few test extensions with known passwords. Practice discovery, extension checks, and reporting against it.
The wiki Basics page carries an edit date of April 13, 2026. Check the repository for the current release before stating a version number in your report, because the search results used for this guide did not establish one.
Discover SIP services with svmap
svmap is the discovery tool. It sends SIP probes to the hosts and ports you specify and reports the devices and PBX servers that answer.
Why the probe method matters
By default, svmap uses OPTIONS, a request that asks a SIP endpoint about its capabilities and typically does not ring a phone. The tool also supports other methods. The guide’s warning about INVITE is the single most important operational point in this tool: an INVITE is a call setup request, and a phone that receives one may ring. Keep INVITE out of the test plan unless the client has approved the ringing effect and warned the affected users.
Ports and ranges
The guide describes scanning default SIP ports and non-default ports. Scanning non-default ports widens coverage, but it also widens the footprint. Limit ranges to the in-scope addresses you listed in your authorization, and do not sweep a whole subnet because it is convenient.
Rank #2
- Supports 4 SIP accounts and 4 multi-purpose line keys
- Swappable faceplate to allow for easy logo customization
- GRP2612W includes built-in dual-band Wi-Fi support. Ethernet cord must be disconnected to enable Wi-Fi capability
- HD audio supporting all major codecs, including wideband codecs G.722 and Opus Up to 16 digital BLF Keys
- Enterprise-level protection including secure boot, dual firmware images, and encrypted data storage
What a clean result does not prove
A scan can miss a device that listens on a non-default port, responds to a method you did not use, or behaves in a way the tool does not recognize. Record which ports and methods you tested, so a reader can see the boundaries of the result.
Check extensions with svwar
svwar tests whether particular extension numbers are active on a PBX and whether authentication is required for them. Its output depends on two things you supply: the candidate extensions and the responses the PBX gives back.
Why you may see no results
The project’s FAQ addresses the common case of an svwar run against a PBX that returns nothing useful. Several causes are possible: the PBX may not respond to the method being used, the extension list may not contain valid numbers, a network filter may drop the traffic, or the PBX may be configured to hide the difference between valid and invalid extensions. Work through those causes in that order before concluding anything.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchResponses that hide enumeration
Some PBXs return the same response for valid and invalid extensions, which defeats the usual method of telling them apart. The FAQ cites Asterisk’s alwaysauthreject=yes setting as one example of this behavior. It is a useful hardening option, but it is not a complete defense: other enumeration methods may still reveal extensions. When you see uniform responses, report that the PBX limited this particular technique, and do not describe the PBX as secure.
Rank #3
- Mid-level phone, ideal for professionals and managers with moderate call load
- Ergonomic design with adjustable display
- Built-in Bluetooth, Wi-Fi
Test passwords with svcrack only when authorized
svcrack attempts SIP digest-authentication passwords for an extension, drawing from a numeric range or a dictionary file. Treat it as the highest-impact tool in the suite.
Expect many REGISTER messages
Running svcrack against several extensions produces a large number of REGISTER messages. The project’s FAQ addresses a question that many first-time users ask: why so many REGISTER messages are sent for the same extensions, while only a few reach the point of an authentication attempt. Read that answer before you start, and make sure your client’s logs and alerting teams know what to expect, because the volume alone can trigger intrusion-detection rules.
Guardrails for password testing
- Test only accounts the client has named in writing, and use test accounts where possible.
- Confirm the PBX’s lockout policy beforehand. Repeated failures can lock real users out of their phones.
- Stop immediately if the client reports lockouts, dropped calls, or service degradation.
- Do not run password attempts against a production PBX during business hours unless the client has explicitly accepted that risk.
Understand svcrash before you go near it
svcrash is described as a tool that responds to certain svwar and svcrack traffic in a way that can crash older versions of those tools. It is meant to show how a poorly built client can be disrupted, not to be pointed at a PBX or phone. Do not run it against any system you do not own, and do not use it in an assessment unless the client has specifically authorized that kind of disruptive test in writing.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Report what you did and what you could not show
svreport manages sessions and exports results in PDF, XML, CSV, and plain text. A useful assessment report records the test window, the in-scope targets, the exact tools and methods used, the tool version, every observation with its raw output, and the limits of each test. Export machine-readable formats such as CSV or XML for the client’s ticketing system, and use PDF for the narrative report if your installation includes ReportLab.
Rank #4
- The phone only works with VoIP
- 2 dual-color line keys (with 2 SIP accounts and up to 2 call appearances), 3 XML programmable context-sensitive soft keys, 3-way conference
- HD wideband audio, superb full-duplex hands-free speakerphone with advanced acoustic echo cancellation and excellent double-talk performance.
- Large phonebook (up to 500 contacts) and call history - up to 200 records
- Automated provisioning using TR-069 or encrypted XML configuration file, SRTP and TLS for advanced security protection, 802.1x for media access control
Read the results as clues, not proof
SIPVicious reports what a particular set of probes received from a particular network path at a particular time. The result depends on the probe method, the ports tested, the extension list, network filters, and how the PBX is configured. Several limits follow from that:
- An empty result is not proof that no extensions exist, that no SIP device is exposed, or that the PBX is secure.
- A positive result is evidence that the device responded to a specific probe. Confirm it with the client’s own configuration records before reporting it as a confirmed exposure.
- The project documentation describes features and setup. It does not provide a measured accuracy or speed benchmark, so do not claim that SIPVicious finds more devices or cracks more passwords than another tool.
- Coverage depends on the lab and the target. Behavior observed in your lab may differ from a client’s PBX with different software, trunk providers, or firewall rules.
Those limits matter most in the final report. A clear statement of what you tested and what you could not test will serve the client better than a list of findings with no context.
In practice, the tool is most useful as a way to confirm how a PBX answers discovery and extension probes under an approved plan, and then to document the results with their limits. Used that way, it gives the client an accurate picture of its SIP exposure without turning the assessment into an outage.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →For a broader view of how this kind of assessment fits into a voice security program, see the rest of this site’s general tech coverage.
Best Value
- Supports 4 (GRP2613) or 6 (GRP2613W) SIP accounts and 6 multipurpose line keys
- Power supply : Integrated Power over Ethernet (PoE) IEEE 802.3af Class 2 or Universal power adapter Input: 100-240V; Output: +5VDC, 0.5A. It does not use batteries.
- Swappable face plates to allow for easy logo customization. Equipped with noise shield technology to minimize background noise
- HD audio with support for all major codecs, including wideband codecs G.722 and Opus. Up to 24 digital BLF keys
- Integrated dual-band (2.4GHz and 5GHz) Wi-Fi 6 (802.11a/b/g/n/ac/ax) and Bluetooth (GRP2613W only)
The guidance above reflects the project’s documentation as of October 2026. Confirm each flag and behavior against the version installed in your environment before a live assessment.
Ask the client for written sign-off before you start, and keep a copy of that sign-off with your test records.
The phone is only part of the attack surface. Test the PBX, the trunk, and the network path in the same authorized window so the report covers what a real attacker would see.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Finally, retest after the client fixes anything. A repeat run against the same extension list and methods shows whether the change actually altered the PBX’s responses.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
