Tessera
Folgen

Sandro Gauci

@sandrogauci.bsky.social

Offensive VoIP/WebRTC security; mostly harmless Offensive VoIP/WebRTC security; mostly harmless enablesecurity.com/blog Chief Mischief Officer @enablesecurity http://savvycal.com/sandrogauci/pub

5 Posts35 Follower8 Folgt
Sandro Gauci@sandrogauci.bsky.social · 6mo ago

Something we've wanted to build for a long time. VoIP/WebRTC security practice has needed a DVWA equivalent. DVRTC is our attempt at that. pbx1.dvrtc.net is live now. enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/

DVRTC - Damn Vulnerable Real-Time Communications

pbx1.dvrtc.net

@enablesecurity.bsky.social · 6mo ago

Web app security has DVWA. Now VoIP/WebRTC security has DVRTC: a hands-on vulnerable lab with SIP, RTP, and TURN exercises. Live instance at pbx1.dvrtc.net. enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/

Sandro Gauci@sandrogauci.bsky.social · 7mo ago

Published the "how to fix it" guides for TURN server security. Copy-paste coturn configs included. Also talking about this on WebRTC Live today: webrtc.ventures/webrtc-live/ enablesecurity.com/blog/turn-security-best-practices/

WebRTC Live

Decision-makers and developers from around the world tune into WebRTC.ventures' monthly WebRTC Live broadcasts to learn about the latest use cases and technical updates for WebRTC and real-time commun...

webrtc.ventures

@enablesecurity.bsky.social · 7mo ago

New: TURN server security best practices + coturn configuration guide with copy-paste templates and three hardening levels. Best practices: enablesecurity.com/blog/turn-security-best-practices/ coturn: enablesecurity.com/blog/coturn-security-configuration-guide/

Sandro Gauci@sandrogauci.bsky.social · 7mo ago

Wrote up our RTCon 2025 talk on TURN security threats. www.enablesecurity.com/blog/turn-se...

TURN Security Threats: A Hacker's View

TURN servers are powerful proxies abused for internal network access, C2 operations, and DDoS attacks. Threat analysis from years of research and pentesting.

enablesecurity.com

@enablesecurity.bsky.social · 7mo ago

TURN servers are meant to relay WebRTC media. To an attacker, they're just proxies. We wrote up the threats we've been finding since 2017: relay abuse, DoS amplification, and software vulns. www.enablesecurity.com/blog/turn-se...

Fred Posner@fred.tel · 9mo ago

I know those of us in the US have had out minds focused on all things Turkey... but now it's time to remember that there are those that read what @sandrogauci.bsky.social / @enablesecurity.bsky.social writes, and those who wish they had. #security #rtc #voip www.enablesecurity.com/newsletter/2...

November 2025: VoIP and WebRTC vulnerability roundup

November 2025 RTCSec newsletter: Cisco UCCX critical RCE, FreePBX command injection, Firefox WebRTC use-after-free, Jitsi OAuth hijacking, PJSIP buffer overflow, AudioCodes EOL vulnerabilities, and Mi...

enablesecurity.com

Fred Posner@fred.tel · 10mo ago

Monthly reminder that there are those who read what @sandrogauci.bsky.social / @enablesecurity.bsky.social writes, and those who wish they had. #security #rtc #voip www.enablesecurity.com/newsletter/2...

October 2025: RTP attacks, Cisco VoIP phones, satellite leaks, and nation-state breaches

October 2025 RTCSec newsletter: RTP Bleed and Inject discussions, critical Cisco VoIP phone vulnerabilities, satellite communication leaks, Ribbon Communications breach, and comprehensive security upd...

enablesecurity.com

@enablesecurity.bsky.social · 11mo ago

Thanks @fred.tel ! This one covers: FreePBX troubles and fixes (CVE-2025-57819 + more) Voice-AI meets toll fraud 📞💸 RTP Bleed clarifications for DTLS-SRTP TURN security deep-dive + Qualcomm & Chrome WebRTC vulns

Fred Posner@fred.tel · 11mo ago

End of the month which means it's time for me to link the @enablesecurity.bsky.social newsletter and say... "There are those who read what @sandrogauci.bsky.social writes... and those who wish they had." www.enablesecurity.com/newsletter/2...

Sandro Gauci@sandrogauci.bsky.social · last yr.

Anyone who should subscribe, its here: www.enablesecurity.com/subscribe/

Subscribe to RTCSec Newsletter & Updates

Subscribe to our monthly RTCSec Newsletter for curated VoIP and WebRTC security news, plus get notifications about new blog posts and research.

enablesecurity.com

@enablesecurity.bsky.social · last yr.

Sent out the latest RTCSec Newsletter, covering Verizon's CDRs compromised by a security researcher, SIP ALG vulnerabilities and learning about NAT types, Cisco VoIP security flaws and cool vulnerability demos, phone phreaking and much more. www.enablesecurity.com/newsletter/2...