{"id":48744571,"url":"https://github.com/EnableSecurity/DVRTC","last_synced_at":"2026-04-28T06:00:59.887Z","repository":{"id":347300832,"uuid":"1191521981","full_name":"EnableSecurity/DVRTC","owner":"EnableSecurity","description":"DVRTC (Damn Vulnerable Real-Time Communications) is an intentionally vulnerable VoIP/WebRTC platform for security training and research, with isolated lab scenarios covering SIP enumeration, digest leaks, RTP bleed, SQL injection, XSS, and TURN relay abuse.","archived":false,"fork":false,"pushed_at":"2026-04-21T11:30:13.000Z","size":2848,"stargazers_count":17,"open_issues_count":0,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-21T12:39:19.775Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EnableSecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":"CLA.md"}},"created_at":"2026-03-25T10:26:20.000Z","updated_at":"2026-04-21T11:21:01.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/EnableSecurity/DVRTC","commit_stats":null,"previous_names":["enablesecurity/dvrtc"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/EnableSecurity/DVRTC","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EnableSecurity%2FDVRTC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EnableSecurity%2FDVRTC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EnableSecurity%2FDVRTC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EnableSecurity%2FDVRTC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EnableSecurity","download_url":"https://codeload.github.com/EnableSecurity/DVRTC/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EnableSecurity%2FDVRTC/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32368534,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-27T20:07:02.737Z","status":"online","status_checked_at":"2026-04-28T02:00:07.250Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-12T10:00:24.383Z","updated_at":"2026-04-28T06:00:59.873Z","avatar_url":"https://github.com/EnableSecurity.png","language":"JavaScript","funding_links":[],"categories":["Interconnect","CTFs and Learning Resources"],"sub_categories":["SBC, IMS"],"readme":"# DVRTC - Damn Vulnerable Real-Time Communications\n\n[![License: PolyForm Noncommercial](https://img.shields.io/badge/License-PolyForm--Noncommercial-blue.svg)](https://polyformproject.org/licenses/noncommercial/1.0.0/)\n\nDVRTC is an intentionally vulnerable VoIP/WebRTC lab for security training and research.\n\n## Warning\n\nDeploy DVRTC only on isolated, dedicated systems. Do not run it alongside production workloads or sensitive data. Expect weak credentials, exposed services, and vulnerable behavior by design.\n\n## What Is DVRTC?\n\nDVRTC packages a vulnerable RTC deployment together with scenario documentation, exercises, and verification tooling. Users can run the stack, explore attack paths, and confirm behavior against the current repository state. The bundled exercises use the included test toolkit, but any external VoIP/RTC security tool works against the stack too (see [awesome-rtc-hacking](https://github.com/EnableSecurity/awesome-rtc-hacking#open-source-tools) for ideas).\n\n## Current Scope\n\nThe repository currently ships two scenarios:\n\n- `pbx1` is the Kamailio/Asterisk/rtpengine scenario.\n- `pbx2` is the OpenSIPS/FreeSWITCH/rtpproxy scenario.\n\nRun only one scenario at a time on a given host. Both scenarios rely on host networking for the core RTC services and reuse overlapping ports, so `pbx1` and `pbx2` cannot run concurrently on the same machine.\n\nScenario summaries:\n\n### `pbx1`\n\n- Stack: Kamailio, Asterisk, rtpengine, coturn, Nginx, and MySQL.\n- Focus: SIP signaling, digest auth leakage, weak credentials, RTP/media abuse, TURN relay abuse, and SIP-adjacent SQL/XSS paths.\n- Exercises: 7 step-by-step exercises and 12 identified attack paths. Additional vulnerable behaviors are covered in the scenario docs and regression checks.\n- Start: `./scripts/compose.sh --scenario pbx1 up -d`\n\n### `pbx2`\n\n- Stack: OpenSIPS, FreeSWITCH, rtpproxy, and the shared web/helper surfaces.\n- Focus: SIP signaling, plaintext traffic analysis, weak credentials, digest leak, RTP/media abuse, recorded packet captures, and SIP flood behavior.\n- Exercises: 8 step-by-step `pbx2` exercise stubs cover the current attack paths. The bundled smoke/regression suites remain the source of truth for reproducibility. The MySQL-backed SQLi/XSS surface from `pbx1` is intentionally not part of `pbx2`.\n- Start: `./scripts/compose.sh --scenario pbx2 up -d`\n\nBoth scenarios use pinned runtime images from the compose manifest set in `compose/base.yml`, `compose/pbx1.yml`, `compose/pbx2.yml`, and `VERSION`. For local rebuilds, see [docs/development.md](docs/development.md).\n\nLive deployments are currently available:\n\n- **pbx1** at `pbx1.dvrtc.net` — see the [pbx1 Scenario Overview](docs/pbx1/overview.md) for public endpoints and usage notes.\n- **pbx2** at `pbx2.dvrtc.net` — see the [pbx2 Scenario Overview](docs/pbx2/overview.md) for public endpoints and usage notes.\n\nVerify reachability before relying on either deployment.\n\nStart here for scenario-specific details:\n\n- [pbx1 Scenario Overview](docs/pbx1/overview.md)\n- [pbx1 Exercise Index](docs/pbx1/exercises/README.md)\n- [pbx1 Architecture](docs/pbx1/architecture.md)\n- [pbx2 Scenario Overview](docs/pbx2/overview.md)\n- [pbx2 Exercise Index](docs/pbx2/exercises/README.md)\n- [pbx2 Architecture](docs/pbx2/architecture.md)\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://pbx1.dvrtc.net/\"\u003e\u003cimg src=\"docs/assets/pbx1-homepage.png\" width=\"45%\" alt=\"pbx1 public deployment screenshot\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://pbx2.dvrtc.net/\"\u003e\u003cimg src=\"docs/assets/pbx2-homepage.png\" width=\"45%\" alt=\"pbx2 public deployment screenshot\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n## Quick Start\n\n### Prerequisites\n\n- Docker 20.10 or newer\n- Docker Compose plugin with `docker compose` support\n- Linux host with host networking support\n- At least 4 CPU cores, 8 GB RAM, and 10 GB disk space recommended for the full stack\n\nIf you are on macOS, use the Colima workflow in [docs/colima-setup.md](docs/colima-setup.md). Direct Docker Desktop deployment on macOS or Windows is not the supported path for this stack.\n\n### Initial Setup\n\n```bash\n./scripts/setup_networking.sh\n./scripts/generate_passwords.sh\n./scripts/init-selfsigned.sh\n./scripts/validate_env.sh\n./scripts/compose.sh --scenario pbx1 up -d\n```\n\nOnce the stack is up, you're ready to jump into the hands-on exercises in the [pbx1 Exercise Index](docs/pbx1/exercises/README.md).\n\nTo start the `pbx2` scenario instead, use:\n\n```bash\n./scripts/compose.sh --scenario pbx2 up -d\n```\n\nEquivalent raw Compose commands are:\n\n```bash\ndocker compose --project-directory . -p dvrtc-pbx1 -f compose/base.yml -f compose/pbx1.yml up -d\ndocker compose --project-directory . -p dvrtc-pbx2 -f compose/base.yml -f compose/pbx2.yml up -d\n```\n\nPlain `docker compose up -d` is not a valid scenario selector here. The base file at `compose/base.yml` only carries shared runner definitions, so it exits with `no service selected` unless you add a scenario file or use the wrapper.\nDo not start both raw scenario commands at the same time on the same host. `pbx1` and `pbx2` overlap on host-networked SIP, web, TURN, and RTP ports. The wrapper script handles this by stopping the other scenario before startup.\n\nIf you want publicly trusted certificates instead of self-signed lab certs, set `DOMAIN` and `EMAIL` in `.env` and use `./scripts/init-letsencrypt.sh` instead.\n\n### Verify The Stack\n\n```bash\n./scripts/compose.sh --scenario pbx1 ps\n```\n\nManual host-shell check (requires `.env` sourced for the IP variable):\n\n```bash\n. ./.env\ncurl \"http://${PUBLIC_IPV4}/\"\n```\n\nWrapper scripts for the bundled test suites:\n\n```bash\n./scripts/testing-smoke.sh\n./scripts/testing-run-all.sh\n./scripts/attacker-run-all.sh\n./scripts/testing-smoke.sh --scenario pbx2\n./scripts/testing-run-all.sh --scenario pbx2\n./scripts/attacker-run-all.sh --scenario pbx2\n```\n\nUse `PUBLIC_IPV4` from `.env` for browser and host-side access checks. On Colima or another Linux VM workflow, that VM address is the canonical DVRTC endpoint even if the platform also forwards ports onto the macOS host. The `testing` runner targets `127.0.0.1` inside the Linux host network namespace. See [TESTING.md](TESTING.md) for the full command reference. Use [`./scripts/compose.sh`](scripts/compose.sh) for normal runtime operations. [`./scripts/dev-compose.sh`](scripts/dev-compose.sh) is the maintainer rebuild wrapper.\n\nFor a quick manual SIP check, register extension `1000` with password `1500` in a SIP client and call `1200` for the echo service.\n\n## Key Documentation\n\n- [pbx1 Scenario Overview](docs/pbx1/overview.md) - credentials, ports, component roles, and scenario entry points\n- [pbx1 Exercise Index](docs/pbx1/exercises/README.md) - current hands-on exercise set\n- [pbx2 Scenario Overview](docs/pbx2/overview.md) - current `pbx2` stack, attack paths, and exposed surfaces\n- [pbx2 Exercise Index](docs/pbx2/exercises/README.md) - current `pbx2` exercise stubs for all known scenario paths\n- [Troubleshooting](docs/troubleshooting.md) - current repo-specific failure modes and diagnostics\n- [Development and Local Builds](docs/development.md) - maintainer rebuild workflow and platform constraints\n- [Contributing](CONTRIBUTING.md) - contribution expectations for this project\n\n## Inspiration\n\nDVRTC was inspired by vulnerable training platforms like [DVWA](https://github.com/digininja/DVWA), [WebGoat](https://owasp.org/www-project-webgoat/), and [WrongSecrets](https://github.com/OWASP/wrongsecrets).\n\n## License\n\nDVRTC is licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE).\n\n## Project Links\n\n- Website: [Enable Security](https://www.enablesecurity.com/)\n- Newsletter: [RTCSec Newsletter (monthly)](https://www.enablesecurity.com/newsletter/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEnableSecurity%2FDVRTC","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FEnableSecurity%2FDVRTC","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEnableSecurity%2FDVRTC/lists"}