Re: Pen Testing a PBX (Northern Telecom Meridian-1)

[Hubert Seiwert <hubert () westpoint ltd uk>]

Check http://www.phrack.org/phrack/47/P47-15 - I don't know how relevant this is 
to the versions that are around today but it may be a starting point. In my 
experience it's very common for users to have bad passwords, i.e. the same as 
their mailbox number. If you can get into any mailbox this obviously leads to 
exposure of voice mails but also potentially to the ability to make outgoing or 
internal phone calls, which may be useful for social engineering attacks within 
the organisation or making long distance and international calls at the 
organisation's expense.


mmarrero () lloydstsb-usa com wrote:
> Hello list, 
>
> I am about to start a pentest of a PBX system. I was wondering if there are any vulnerabilities against this make and model of PBX. Also, does anyone know of a paper on how to appropriately conduct a pentest. I do not want to miss anything. 



--
Hubert Seiwert

Internet Security Specialist, Westpoint Ltd
Albion Wharf, 19 Albion Street, Manchester M1 5LN, United Kingdom

Web: www.westpoint.ltd.uk
Tel: +44-161-2371028

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------