PAGES
← all tools
◆ Reconnaissance & OSINT

sippts

v4.2.1 open-source

SIPPTS is a set of scripts, programmed in Python, for auditing VoIP servers and devices using the SIP protocol.

source ↗ rss ↗ What is a cyber toolchain? last repo push Sep 14, 2026

Summary

sippts is an open-source command-line toolset, written in Python, for auditing VoIP servers and devices that speak the SIP protocol; it is free to use, modify and distribute. It bundles modules for scanning networks and port ranges, enumerating extensions, cracking credentials, sniffing and spoofing traffic, and pulling SIP, RTP and RTP-to-WAV data out of PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. captures, run individually from a single sippts command. It is aimed at penetration testers and VoIP administrators checking their own infrastructure rather than at general network scanning teams. First committed in 2015 with 12 contributors, it has settled into a slow maintenance pace: three commits in the past year and a last release over 600 days ago, so treat it as stable rather than actively evolving.

SIPPTS is a set of scripts, programmed in Python, for auditing VoIP servers and devices using the SIP protocol.

How sippts helps

Which hosts on my network are actually running SIP services?

sends probes across the local network or a given range and lists the devices that answer, so unadvertised or forgotten SIP endpoints surface

Which extensions on a SIP server can be reached without valid credentials?

walks a range of extension numbers against the server and reports which ones exist and respond, marking which accept registration

Which of my SIP accounts are protected by weak or guessable passwords?

runs credential attacks against the registrar using supplied wordlists and reports which extensions authenticate successfully

Is this SIP server exposed to a known vulnerability?

fingerprints the server's software and version from its responses and checks it against a maintained list of known CVEs, naming the ones that match

What actually happened in a call captured on the wire?

pulls the SIP signaling, RTP streams, and reconstructed audio out of a saved capture file, so the call setup and content can be reviewed after the fact

Can an attacker on this network intercept or redirect an active call?

offers sniffing and spoofing modules that capture live SIP traffic or inject spoofed messages, showing whether call hijacking or media interception succeeds against the target infrastructure

all 11 features, with the evidence for each →

Languages

Not documented

Features

11 capabilities · 5 backed by code, an API document or a real run

Built from sippts's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • sippts covers 1 of the 13 network discovery and scanning capabilities we track.

What sippts offers you

All capabilities 11 capabilities
SIP signaling customization and control verified Allows fine-grained control of SIP message parameters including PPI/PAI domains, content types, max-forwards, REFER targets, replaces headers, event subscriptions, and timed hangups. 7 releases · 2 other sources · first seen Sep 2026

release 7 total

  • Adds -ppid and -paid parameters to send module for PPI and PAI domain settings v4.2.1 · Sep 2026 · source · release history
  • Adds -body and -content-type parameters to send module for MESSAGE content v4.2.1 · Sep 2026 · source · release history
  • Adds -refer-to parameter to send module to specify REFER target instead of default 999 v4.2.1 · Sep 2026 · source · release history
  • Adds -mf parameter to send and ping modules to set Max-Forwards value v4.2.1 · Sep 2026 · source · release history
  • Adds -replaces parameter to invite and send modules for attended transfer support v4.2.1 · Sep 2026 · source · release history
  • Adds -hangup parameter to invite module to send BYE after N seconds v4.2.1 · Sep 2026 · source · release history

command line

  • -replaces — Add Replaces to the REFER of -t, turning the blind transfer into an attended one: "callid;to-tag=X;from-tag=Y". Get the values from sippts dump or sippts sniff v4.2.1 · Sep 2026 · command-line history

example

  • Hijack an existing SIP call sippts send -i 192.168.0.1 -m INVITE -replaces "CALLID;to-tag=X;from-tag=Y"
Asterisk AMI testing verified Sends commands to the Asterisk Manager Interface (AMI) to support AMI pentesting. 5 other sources · first seen Sep 2024

Also counts toward: Command-line interface

command line

example

  • Inspect TLS certificates for vulnerabilities like expired certs or weak keys during a scan. sippts scan -target <host> -tlsinfo v4.2.1 · Sep 2026 · source
  • Perform dictionary cracking on a SIP user with custom challenge parameters for the attack. sippts dcrack -target <host> -u <user> -f <wordlist> -realm example.com -alg MD5 -nonce abc123 v4.2.1 · Sep 2026 · source
  • Subscribe to specific SIP events using the send module with custom accept headers. sippts send -target <host> -event info -accept application/sdp -se sip v4.2.1 · Sep 2026 · source
PCAP file analysis verified Extracts and inspects data from PCAP network capture files. 2 releases · 2 other sources · first seen Jul 2024

release

  • Adds -r PORT parameter to sniff module to set BPF capture port filter v4.2.1 · Sep 2026 · source · release history
  • Adds CVSS column (v0.5) to data/cve.csv for severity scoring in CVE reports v4.2.1 · Sep 2026 · source · release history

docs

  • Set of cyber tools for auditing VoIP servers and devices using the SIP protocol, covering scanning, extension enumeration, password cracking, sniffing, and RTP

command line

SIP extension enumeration shipped Identifies valid SIP extensions and supports reading targets from files. 2 releases · 2 other sources · first seen Sep 2026

Shared capability: Attack surface inventory

Also counts toward: Command-line interface

release

  • Adds -oe parameter to exten module to save found extensions to output v4.2.1 · Sep 2026 · source · release history
  • Adds -f parameter to exten and rcrack modules to read targets from a file v4.2.1 · Sep 2026 · source · release history

docs

  • Set of cyber tools for auditing VoIP servers and devices using the SIP protocol, covering scanning, extension enumeration, password cracking, sniffing, and RTP

example

  • Enumerate supported SIP methods sippts enumerate -i 192.168.0.1
SIP brute-force and credential recovery shipped Performs dictionary attacks on SIP users with customizable challenge parameters and supports writing results to files. 3 releases · first seen Sep 2026

Also counts toward: Command-line interface

release

  • Adds -realm, -alg, -nonce, and -t parameters to leak module for challenge customization and timeout control v4.2.1 · Sep 2026 · source · release history
  • Adds -o parameter to rcrack and dcrack modules to write results to a file v4.2.1 · Sep 2026 · source · release history
  • Adds -ef parameter to rcrack module to read extension list from a file v4.2.1 · Sep 2026 · source · release history
TLS protocol and certificate auditing verified suggested Tests specific TLS versions individually and inspects server certificates for weaknesses or expiration. 1 release · 2 other sources · first seen Sep 2026

Suggested capability: Service and version detection. This is our guess, not confirmed.

Also counts toward: Command-line interface

release

  • Adds -tlsinfo parameter to scan module to detect expired, self-signed, weak keys, and name mismatches in TLS certificates v4.2.1 · Sep 2026 · source · release history

command line

  • -tlsversions — With -tlsinfo, also try TLS 1.0/1.1/1.2/1.3 one by one. It is one extra handshake per version and per host, done once per host:port. SSLv2/SSLv3 cannot be tested: this OpenSSL does not offer them v4.2.1 · Sep 2026 · command-line history
  • -tlsinfo — With -p tls, read the certificate the server presents (subject, issuer, dates, key, signature) and report weak or expired ones. It costs no extra connection: the handshake already happens v4.2.1 · Sep 2026 · command-line history
Network scanning shipped Scans local networks and port ranges for active services using high concurrency. 3 other sources

Shared capability: Attack surface inventory

example

  • Scan local network for SIP services sippts scan -i 192.168.0.0/24
  • Scan port range across all protocols sippts scan -i 192.168.0.0/24 -r 5060-5080 -p all
  • Scan all ports with 500 threads sippts scan -f targets.txt -r all -p all -th 500 -ua Grandstream
CVE data enrichment shipped Incorporates CVSS v0.5 severity scores into CVE reports for vulnerability context. 1 release · first seen Sep 2026

release

  • Adds a 6th column to data/cve.csv carrying the CVSS score (list version 0.5), readable by sippts 4.2.1 or newer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v4.2.1 · Sep 2026 · source · release history
Animated help verified Provides animated video-based help to guide users through tool usage. 1 other source · first seen Jul 2024

command line

SIP call interception shipped Captures and takes control of ongoing SIP sessions to manipulate or monitor traffic. 1 other source

example

  • Hijack an existing SIP call sippts send -i 192.168.0.1 -m INVITE -replaces "CALLID;to-tag=X;from-tag=Y"
Vulnerability assessment shipped Fingerprints targets and checks them against known CVEs with severity data. 1 other source

example

  • Fingerprint and check known CVEs sippts scan -i 192.168.0.0/24 -fp -cve

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for sippts, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail sippts puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. September 20261

    1 entry

    1. v4.2.1 Sep 14, 2026 · issue 075

      sippts v4.2.1 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scoring with severity colours to CVE results, ordering findings worst-first in the scan module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.2.1 https://github.com/Pepelux/sippts.git
# already have the repo? check out this version:
$ git checkout v4.2.1
      • Adds a 6th column to data/cve.csv carrying the CVSS score (list version 0.5), readable by sippts 4.2.1 or newer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in Pepelux/sippts, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 ±0 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 0 of 29 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 1
    4. Commits / month 24
    5. Stars 572
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback