Open5GS — 5G SA Core & 4G EPC Suite

Open5GS is an open-source implementation for 5G Core Network and 4G LTE Evolved Packet Core (EPC). Within TelcoChisel, Open5GS is pre-configured with real-time logging, loopback network interfaces, MongoDB database bindings, and integrated Wireshark dissectors for inspecting 5G Service-Based Architecture (SBA) HTTP/2 JSON REST interfaces.

Key Capabilities & Attack Surface Testing

• 5G SBA (Service-Based Architecture) Verification: Test HTTP/2 SBI interfaces across AMF, SMF, NRF, NSSF, AUSF, UDM, and PCF.
• SUPI / SUCI De-concealment Audits: Validate ECIES Profile A & Profile B key derivation implementations on UDM/AUSF.
• Rogue gNodeB Authentication: Audit AMF vulnerability against unauthorized N2/N3 connection attempts and SCTP malformed payloads.
• GTP-U User Plane Penetration: Test UPF TEID allocation, GTP encapsulation injection, and subscriber data leaks.

Pre-installed TelcoChisel Cheatsheet

1. Launch All 5G Core Network Functions

# Start the entire 5G Standalone Core suite
sudo systemctl start open5gs-nrfd open5gs-amfd open5gs-smfd open5gs-upfd open5gs-udmd open5gs-ausfd open5gs-nssfd open5gs-pcfd open5gs-bsfd open5gs-udrd

2. Live SBA Packet Capture (HTTP/2 / SBI)

# Capture all internal 5G Service-Based Architecture signaling on loopback
sudo tshark -i lo -f "tcp port 7777 or tcp port 8000" -Y "http2" -T fields -e ip.src -e ip.dst -e http2.header.value

3. Subscriber Database Provisioning

# Access the web administration portal (pre-installed on port 3000)
open-browser http://127.0.0.1:3000
# Default Credentials: admin / 1423

Practice in TelcoSec Cloud Academy

To practice compromising, intercepting, and hardening 5G Core network functions in isolated cloud virtual machines with real simulated UEs and gNodeBs: 👉 Access the 5G Core Red Team Lab at App.TelcoSec.Net