Hi all, long time no.. read? I wanted to share an article I published through my current employer - STACKTITAN! If you don't want to watch me ramble about my shortcomings, the article is here. I had a social engineering engagement recently where Spoofcard failed me. So I wanted to understand exactly what was happening behind the scenes, and build my own call spoofing rig. Thanks to the seemingly all-knowing Chris Patten, I was pointed in the direction of FreePBX and IncrediblePBX.

Initially I started trying to configure FreePBX, but the VM kept crashing so I put it down and worked on other projects. Then Chris sent me this article from Nerd Vittles. This simplified the configuration, but made me work harder to understand the concepts as a lot of the work was done behind the scenes in the setup script. Moving on, I had choices. So many choices of SIP trunk providers. So I just picked one with a short paragraph on the Nerd Vittles article - less reading means easier and less steps, right? Yeah, no. I picked VoIP.ms, and once I figured out which softphone app I wanted to use, finally got it configured to register to the PBX, I couldn't make outbound calls. It was like beating my head against a brick wall as I made configuration change after configuration change but still receiving the ominous "all routes are currently busy" message. Chris to the rescue again! "Hey, did you set up a dial plan?" A what? Well, in case you get going down this route, the "Add some code in extensions_custom.conf" section in this VoIP.ms wiki article is what I was missing.

Finally, I can make calls! Now time to spoof. I changed the appropriate parameters in Incredible PBX, tried to make a call, and "Your call cannot be completed as dialed". 

Turns out, even if you specify that your PBX will define it's own caller ID, VoIP.ms requires you to verify that you own the number you own. Well, from here I moved on to Skyetel, and it worked! The only caveat here is you have to sign up using a company email and provide your ID to them.

Anyways, thanks for reading! In case you missed it up top, here's the article Chris and I wrote: https://rift.stacktitan.com/cid-spoofing/