gNBSim — 5G SA gNodeB & Multi-UE Simulator

gNBSim is an indispensable 5G Standalone load generation and security auditing tool. It simulates the behavior of hundreds of 5G UEs and gNodeBs concurrently without needing physical SDR radios, communicating directly over SCTP (N2/NG-AP) and GTP-U (N3) with any 3GPP-compliant 5G Core.

Security Testing Applications

• 5G Core High-Volume Registration Flooding: Test AMF resistance against high-frequency Registration Request bursts (DDoS resilience).
• NG-AP Malformed Message Injection: Send fuzzing payloads inside NGAP InitialUEMessage containers to uncover memory safety vulnerabilities in Core AMF parsers.
• PDU Session Hijacking: Test SMF and UPF TEID collision handling during simultaneous PDU Session Establishment requests.

Pre-installed TelcoChisel Cheatsheet

1. Execute Simulated 5G Registration Workflow

# Run automated 5G Registration and PDU Session establishment
gnbsim --cfg /etc/gnbsim/default.json --run="ue-reg-pdu-test"

2. Capture N2/N3 Signaling in Wireshark

# Capture NGAP and GTP-U signaling during the simulation
sudo tshark -i lo -f "sctp port 38412 or udp port 2152" -w /tmp/5g_sim_capture.pcap

Practice in TelcoSec Cloud Academy

To practice automated 5G Core penetration testing with gNBSim and UERANSIM: 👉 Access the 5G SBA Automation Lab at App.TelcoSec.Net