ACE VoIP Directory Tool
ACE (Automated Corporate Enumerator) is a simple yet powerful VoIP Corporate Directory enumeration tool that mimics the behavior of an IP Phone in order to download the name and extension entries that a given phone can display on its screen interface. In the same way that the "corporate directory" feature of VoIP hard phones enables users to easily dial by name via their VoIP handsets,

ACE was developed as a research idea born from "VoIP Hopper" to automate VoIP attacks that can be targeted against names in an enterprise Directory. The concept is that in the future, attacks will be carried out against users based on their name, rather than targeting VoIP traffic against random RTP audio streams or IP addresses. ACE works by using DHCP, TFTP, and HTTP in order to download the VoIP corporate directory. It then outputs the directory to a text file, which can be used as input to other VoIP assessment tools. ACE is a standalone utility, but its functions are integrated into UCSniff.

ACE currently supports the VoIP corporate directory used in Cisco Unified IP Phones. It works in the following way:

1)Spoofs CDP to get VVID
2)Adds Voice VLAN Interface (VLAN Hop) - subsequent traffic is tagged with VVID
3)Sends DHCP request tagged with VVID
4)Decodes TFTP Server IP Address via DHCP Option 150
5)Sends a TFTP request for IP Phone configuration file
6)Parses file, learning Corporate Directory URL
7)Sends an HTTP GET request for Directory
8)Parses XML Data, writing directory users to a formatted text file