9.2.12 SIP and IRC Triage

← Stage index | Service cheatsheet | Strategy map | Study methods: Extract opportunities from services

These source-site topics contain only first-pass reconnaissance. Treat them as application-identification branches, not default exploitation paths.

9.2.12.1 Find SIP identity and configuration clues SIP

Commonly UDP/TCP 5060 or TLS 5061; follow protocol evidence.

nmap -Pn -sU -sV --script sip-methods -p 5060 TARGET
nmap -Pn -sT -sV --script sip-methods -p 5060 TARGET

Decisive output: a SIP response and supported methods. open|filtered without application response remains ambiguous. Do not run sip-brute until the exact registrar, known test identities, lockout policy and explicit authorization are established.

9.2.12.2 Find IRC identity and configuration clues IRC

nmap -Pn -sV --script irc-info -p PORT TARGET
nc -nv TARGET PORT

Minimal registration for an authorized test client:

NICK testnick
USER testuser 0 * :Test User
QUIT

Decisive output: IRC numeric replies, server/network name, version/capabilities or authentication requirement. Do not use irc-brute as identification; authenticate only with legitimately acquired credentials.

9.2.12.3 Sources

getSH Scan route, source snapshot e1f62dd
Nmap NSE documentation