SIP and IRC Triage

← Stage index | Service cheatsheet | Strategy map | Study methods: Extract opportunities from services

These source-site topics contain only first-pass reconnaissance. Treat them as application-identification branches, not default exploitation paths.

SIP

Commonly UDP/TCP 5060 or TLS 5061; follow protocol evidence.

Copynmap -Pn -sU -sV --script sip-methods -p 5060 TARGET
nmap -Pn -sT -sV --script sip-methods -p 5060 TARGET

Decisive output: a SIP response and supported methods. open|filtered without application response remains ambiguous. Do not run sip-brute until the exact registrar, known test identities, lockout policy and explicit authorization are established.

IRC

Copynmap -Pn -sV --script irc-info -p PORT TARGET
nc -nv TARGET PORT

Minimal registration for an authorized test client:

CopyNICK testnick
USER testuser 0 * :Test User
QUIT

Decisive output: IRC numeric replies, server/network name, version/capabilities or authentication requirement. Do not use irc-brute as identification; authenticate only with legitimately acquired credentials.

Sources

• getSH Scan route, source snapshot e1f62dd
• Nmap NSE documentation