Web application security has DVWA and WebGoat. VoIP and WebRTC security hasn't had anything like it ... until now.

We built DVRTC (Damn Vulnerable Real-Time Communications): a hands-on lab for learning VoIP/WebRTC attack techniques. Full dockerized stack with Kamailio, Asterisk, rtpengine, and coturn — each configured to exhibit specific vulnerable behaviors.

7 exercises covering SIP extension enumeration, RTP bleed, SIP digest leaks, credential cracking (online and offline), TURN relay abuse, and traffic analysis. There's a live instance at pbx1.dvrtc.net you can test against right now.

https://www.enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/

GitHub: https://github.com/EnableSecurity/DVRTC/

#infosec #webrtc #voipsecurity #sipsecurity #penetrationtesting #training #TURN

RIP one of our favorite techniques to bypass #PaloAlto #Cortex #XDR 🤷

https://labs.infoguard.ch/posts/decrypting-and-abusing_paloalto-cortex-xdr_behavioral-rules_biocs/

"Microsoft 365 has more than 450 million paid commercial seats. After roughly two years on the market, Copilot has converted approximately 15 million of them into paying users. That's a 3.3% conversion rate, at $30 per user per month, generating roughly $5.4 billion in annual revenue. That's less than what Microsoft spent on infrastructure in a single quarter (3)."

None of the numbers make economic sense.

https://finance.yahoo.com/markets/stocks/articles/nadella-paid-650m-recruit-ai-170000361.html?guccounter=1