Web app security has DVWA. Now VoIP/WebRTC security has DVRTC: a hands-on vulnerable lab with SIP, RTP, and TURN exercises. Live instance at pbx1.dvrtc.net. enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/

New: TURN server security best practices + coturn configuration guide with copy-paste templates and three hardening levels. Best practices: enablesecurity.com/blog/turn-security-best-practices/ coturn: enablesecurity.com/blog/coturn-security-configuration-guide/

TURN Server Security Best Practices

TURN server security guide for any implementation. Hardening checklist, IP range block lists, rate limiting, and deployment patterns for production WebRTC systems.

enablesecurity.com

TURN servers are meant to relay WebRTC media. To an attacker, they're just proxies. We wrote up the threats we've been finding since 2017: relay abuse, DoS amplification, and software vulns. www.enablesecurity.com/blog/turn-se...

TURN Security Threats: A Hacker's View

TURN servers are powerful proxies abused for internal network access, C2 operations, and DDoS attacks. Threat analysis from years of research and pentesting.

enablesecurity.com

There are those who read what @sandrogauci.bsky.social and @enablesecurity.bsky.social write... and those who wish they had. www.enablesecurity.com/newsletter/2... #voip #security #rtc #freepbx

January 2026: Cisco UCM zero-day, 39C3 telco talks, FreePBX exploitation

January 2026 RTCSec newsletter: Cisco UCM zero-day, 39C3 telco talks, FreePBX web shell in the wild, Element Call, voice AI risks, Yealink RPS CVE, and more

enablesecurity.com

Thanks @fred.tel ! This one covers: FreePBX troubles and fixes (CVE-2025-57819 + more) Voice-AI meets toll fraud 📞💸 RTP Bleed clarifications for DTLS-SRTP TURN security deep-dive + Qualcomm & Chrome WebRTC vulns

Fred Posner@fred.tel · last yr.

End of the month which means it's time for me to link the @enablesecurity.bsky.social newsletter and say... "There are those who read what @sandrogauci.bsky.social writes... and those who wish they had." www.enablesecurity.com/newsletter/2...

Sent out the latest RTCSec Newsletter, covering Verizon's CDRs compromised by a security researcher, SIP ALG vulnerabilities and learning about NAT types, Cisco VoIP security flaws and cool vulnerability demos, phone phreaking and much more. www.enablesecurity.com/newsletter/2...

April 2025: Verizon's CDR compromise, Cisco VoIP security flaws and phreaking

April 2025 RTCSec newsletter: Verizon's CDR compromise, Cisco VoIP security flaws and phreaking

enablesecurity.com