AI
WebRTC for Web Security Testers: What You Need to Know
WebRTC is browser technology for voice, video, and peer-to-peer data transfer with no plugins required. Every modern browser ships it built in. The spec targets real-time communication, and latency is the critical constraint. A few seconds of delay desynchronizes audio and video. Users switch platforms immediately. That makes availability a security concern equal to confidentiality and integrity. Denial of service on a WebRTC platform is not just an annoyance. It renders the service worthless.
WebRTC’s Mandatory Security Stack
WebRTC enforces security at the browser level. HTTPS is required before any WebRTC API call works. Audio and video are encrypted with SRTP, the secure variant of RTP. DTLS handles key exchange over UDP, but only to establish a master key, then hands off to SRTP. That separation exists because TLS adds too much latency for real-time use. DTLS certificates are often self-signed and dynamically generated, but a cryptographic fingerprint transmitted through signaling binds them to the session, preventing substitution.
Where the Attack Surface Grows
WebRTC is a secure standard, but the attack surface is large. Three component types each carry distinct risks. Signaling uses WebSockets or HTTP APIs, familiar territory for web testers. The media layer transfers SRTP packets and has its own set of vulnerabilities. TURN servers relay media for clients behind firewalls that block UDP. Each component runs different protocols. Custom signaling protocols are common since WebRTC defines none, and developers who write their own often reintroduce classic vulnerabilities.
TURN Server Relay Abuse: Reaching Internal Services
TURN servers relay media for clients behind firewalls. They act as proxies for UDP traffic. Gauci’s team noticed this looked exploitable the same way SSRF works against HTTP proxies. They built an internal tool called Stunner that routes a SOCKS proxy through a TURN server. Using it, they accessed internal services like the AWS metadata endpoint and local addresses that assume trust based on source IP. They reported this in a bug bounty against Slack, which was published. Coturn patched the underlying bypass, but misconfigured servers remain common.
RTP Injection and Signaling Flood Denial of Service
Two more vulnerabilities from Enable Security’s pentest history. RTP injection sends raw unencrypted RTP to a UDP port already handling an active call on a media server. The server may accept it, either forwarding injected audio to the victim or dropping into undefined behavior. In practice this usually causes denial of service by spraying UDP packets across a port range. Signaling flood is simpler: flooding a SIP-over-WebSocket server with INVITE messages overwhelmed Gauci’s demo server, dropping all calls within seconds. Recovery happened as soon as the flood stopped.
Testing Tools and OWASP ASVS Integration
For TURN server testing, use the public Stunner tool on GitHub by Christian. For signaling, standard web proxy tools like OWASP ZAP work well. Wireshark is essential for media analysis. GStreamer sends RTP traffic for testing. Enable Security maintains the Awesome RTC Hacking GitHub repository listing open-source and commercial tools. Enable Security also contributed a new WebRTC chapter to OWASP ASVS, covering 12 requirements across TURN configuration, media, and signaling. One constraint: any proposed requirement must work across platforms, and must not add latency.
Notable Quotes
it’s okay actually fine relax Sandro Gauci · ▶ Watch (17:18)
surprised when it actually worked after Sandro Gauci · ▶ Watch (25:43)
just because something is said to be secure Sandro Gauci · ▶ Watch (45:16)
Key Takeaways
- TURN servers are exploitable like SSRF proxies; a coturn bypass let Enable Security reach Slack’s internal services.
- RTP injection on an active media server port injects audio or silences calls via undefined UDP handling.
- WebRTC now has a dedicated OWASP ASVS chapter with 12 requirements covering TURN, media, and signaling.
About the Speaker(s)
Sandro Gauci leads operations and research at Enable Security, where he specializes in VoIP and WebRTC security. He started in cybersecurity in 2000 and is the original developer of SIPVicious OSS, the SIP security testing toolset.