[{"data":1,"prerenderedAt":316},["ShallowReactive",2],{"tool-doc-sctpscan":3,"content-query-Nzec5X79XA":192},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"name":8,"protocol":10,"category":11,"hardware":12,"command":13,"academyLab":14,"body":15,"_type":186,"_id":187,"_source":188,"_file":189,"_stem":190,"_extension":191},"\u002Ftools\u002Fsctpscan","tools",false,"","SCTPScan","SCTP network scanner for discovering telecom signaling endpoints including SIGTRAN SS7 nodes, Diameter peers, and S1-MME interfaces on carrier networks.","SS7 \u002F SIGTRAN \u002F Diameter","Network Scanner","Ethernet Interface","sctpscan -d 10.0.0.0\u002F24 -p 2905,3868","https:\u002F\u002Fapp.telcosec.net",{"type":16,"children":17,"toc":175},"root",[18,27,45,52,97,103,110,123,129,138,144,153,159],{"type":19,"tag":20,"props":21,"children":23},"element","h1",{"id":22},"sctpscan-sctp-telecom-signaling-discovery-scanner",[24],{"type":25,"value":26},"text","SCTPScan — SCTP Telecom Signaling Discovery Scanner",{"type":19,"tag":28,"props":29,"children":30},"p",{},[31,36,38,43],{"type":19,"tag":32,"props":33,"children":34},"strong",{},[35],{"type":25,"value":8},{"type":25,"value":37}," is a specialized network scanner for the Stream Control Transmission Protocol (SCTP), the transport protocol underpinning all modern telecom signaling. Within ",{"type":19,"tag":32,"props":39,"children":40},{},[41],{"type":25,"value":42},"TelcoChisel",{"type":25,"value":44},", it is used to discover SIGTRAN SS7 signaling endpoints (M2UA\u002FM3UA), Diameter peers (S6a, Gx, Gy), and 4G\u002F5G S1-AP\u002FNG-AP interfaces during carrier network penetration tests.",{"type":19,"tag":46,"props":47,"children":49},"h2",{"id":48},"key-capabilities-security-vectors",[50],{"type":25,"value":51},"Key Capabilities & Security Vectors",{"type":19,"tag":53,"props":54,"children":55},"ul",{},[56,67,77,87],{"type":19,"tag":57,"props":58,"children":59},"li",{},[60,65],{"type":19,"tag":32,"props":61,"children":62},{},[63],{"type":25,"value":64},"SIGTRAN Endpoint Discovery",{"type":25,"value":66},": Scan IP ranges for M2UA (port 2904), M3UA (port 2905), and SUA (port 14001) signaling gateways.",{"type":19,"tag":57,"props":68,"children":69},{},[70,75],{"type":19,"tag":32,"props":71,"children":72},{},[73],{"type":25,"value":74},"Diameter Peer Enumeration",{"type":25,"value":76},": Identify Diameter relay agents and proxies on standard ports (3868 TCP\u002FSCTP) for S6a\u002FGx\u002FGy testing.",{"type":19,"tag":57,"props":78,"children":79},{},[80,85],{"type":19,"tag":32,"props":81,"children":82},{},[83],{"type":25,"value":84},"S1-MME \u002F NG-AP Discovery",{"type":25,"value":86},": Find exposed eNodeB and gNodeB SCTP associations on carrier infrastructure (port 36412 \u002F 38412).",{"type":19,"tag":57,"props":88,"children":89},{},[90,95],{"type":19,"tag":32,"props":91,"children":92},{},[93],{"type":25,"value":94},"SCTP INIT Fingerprinting",{"type":25,"value":96},": Fingerprint SCTP stack implementations to identify vendor-specific signaling equipment.",{"type":19,"tag":46,"props":98,"children":100},{"id":99},"telcochisel-execution-cheatsheet",[101],{"type":25,"value":102},"TelcoChisel Execution Cheatsheet",{"type":19,"tag":104,"props":105,"children":107},"h3",{"id":106},"_1-scan-for-sigtran-ss7-nodes",[108],{"type":25,"value":109},"1. Scan for SIGTRAN SS7 Nodes",{"type":19,"tag":111,"props":112,"children":117},"pre",{"className":113,"code":115,"language":116,"meta":7},[114],"language-bash","# Discover M3UA signaling transfer points on a carrier subnet\nsudo sctpscan -d 10.0.0.0\u002F24 -p 2905 -r\n","bash",[118],{"type":19,"tag":119,"props":120,"children":121},"code",{"__ignoreMap":7},[122],{"type":25,"value":115},{"type":19,"tag":104,"props":124,"children":126},{"id":125},"_2-scan-for-diameter-peers",[127],{"type":25,"value":128},"2. Scan for Diameter Peers",{"type":19,"tag":111,"props":130,"children":133},{"className":131,"code":132,"language":116,"meta":7},[114],"# Find Diameter relay agents (HSS, PCRF, OCS endpoints)\nsudo sctpscan -d 172.16.0.0\u002F16 -p 3868 -r\n",[134],{"type":19,"tag":119,"props":135,"children":136},{"__ignoreMap":7},[137],{"type":25,"value":132},{"type":19,"tag":104,"props":139,"children":141},{"id":140},"_3-enumerate-s1-mme-interfaces",[142],{"type":25,"value":143},"3. Enumerate S1-MME Interfaces",{"type":19,"tag":111,"props":145,"children":148},{"className":146,"code":147,"language":116,"meta":7},[114],"# Discover LTE eNodeB S1-AP SCTP associations\nsudo sctpscan -d 192.168.0.0\u002F16 -p 36412 -r\n",[149],{"type":19,"tag":119,"props":150,"children":151},{"__ignoreMap":7},[152],{"type":25,"value":147},{"type":19,"tag":46,"props":154,"children":156},{"id":155},"practice-in-telcosec-academy",[157],{"type":25,"value":158},"Practice in TelcoSec Academy",{"type":19,"tag":28,"props":160,"children":161},{},[162,164],{"type":25,"value":163},"👉 ",{"type":19,"tag":32,"props":165,"children":166},{},[167],{"type":19,"tag":168,"props":169,"children":172},"a",{"href":14,"rel":170},[171],"nofollow",[173],{"type":25,"value":174},"Launch SCTP Reconnaissance Lab on App.TelcoSec.Net",{"title":7,"searchDepth":176,"depth":176,"links":177},2,[178,179,185],{"id":48,"depth":176,"text":51},{"id":99,"depth":176,"text":102,"children":180},[181,183,184],{"id":106,"depth":182,"text":109},3,{"id":125,"depth":182,"text":128},{"id":140,"depth":182,"text":143},{"id":155,"depth":176,"text":158},"markdown","content:tools:sctpscan.md","content","tools\u002Fsctpscan.md","tools\u002Fsctpscan","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"name":8,"protocol":10,"category":11,"hardware":12,"command":13,"academyLab":14,"body":193,"_type":186,"_id":187,"_source":188,"_file":189,"_stem":190,"_extension":191},{"type":16,"children":194,"toc":307},[195,199,212,216,251,255,259,267,271,279,283,291,295],{"type":19,"tag":20,"props":196,"children":197},{"id":22},[198],{"type":25,"value":26},{"type":19,"tag":28,"props":200,"children":201},{},[202,206,207,211],{"type":19,"tag":32,"props":203,"children":204},{},[205],{"type":25,"value":8},{"type":25,"value":37},{"type":19,"tag":32,"props":208,"children":209},{},[210],{"type":25,"value":42},{"type":25,"value":44},{"type":19,"tag":46,"props":213,"children":214},{"id":48},[215],{"type":25,"value":51},{"type":19,"tag":53,"props":217,"children":218},{},[219,227,235,243],{"type":19,"tag":57,"props":220,"children":221},{},[222,226],{"type":19,"tag":32,"props":223,"children":224},{},[225],{"type":25,"value":64},{"type":25,"value":66},{"type":19,"tag":57,"props":228,"children":229},{},[230,234],{"type":19,"tag":32,"props":231,"children":232},{},[233],{"type":25,"value":74},{"type":25,"value":76},{"type":19,"tag":57,"props":236,"children":237},{},[238,242],{"type":19,"tag":32,"props":239,"children":240},{},[241],{"type":25,"value":84},{"type":25,"value":86},{"type":19,"tag":57,"props":244,"children":245},{},[246,250],{"type":19,"tag":32,"props":247,"children":248},{},[249],{"type":25,"value":94},{"type":25,"value":96},{"type":19,"tag":46,"props":252,"children":253},{"id":99},[254],{"type":25,"value":102},{"type":19,"tag":104,"props":256,"children":257},{"id":106},[258],{"type":25,"value":109},{"type":19,"tag":111,"props":260,"children":262},{"className":261,"code":115,"language":116,"meta":7},[114],[263],{"type":19,"tag":119,"props":264,"children":265},{"__ignoreMap":7},[266],{"type":25,"value":115},{"type":19,"tag":104,"props":268,"children":269},{"id":125},[270],{"type":25,"value":128},{"type":19,"tag":111,"props":272,"children":274},{"className":273,"code":132,"language":116,"meta":7},[114],[275],{"type":19,"tag":119,"props":276,"children":277},{"__ignoreMap":7},[278],{"type":25,"value":132},{"type":19,"tag":104,"props":280,"children":281},{"id":140},[282],{"type":25,"value":143},{"type":19,"tag":111,"props":284,"children":286},{"className":285,"code":147,"language":116,"meta":7},[114],[287],{"type":19,"tag":119,"props":288,"children":289},{"__ignoreMap":7},[290],{"type":25,"value":147},{"type":19,"tag":46,"props":292,"children":293},{"id":155},[294],{"type":25,"value":158},{"type":19,"tag":28,"props":296,"children":297},{},[298,299],{"type":25,"value":163},{"type":19,"tag":32,"props":300,"children":301},{},[302],{"type":19,"tag":168,"props":303,"children":305},{"href":14,"rel":304},[171],[306],{"type":25,"value":174},{"title":7,"searchDepth":176,"depth":176,"links":308},[309,310,315],{"id":48,"depth":176,"text":51},{"id":99,"depth":176,"text":102,"children":311},[312,313,314],{"id":106,"depth":182,"text":109},{"id":125,"depth":182,"text":128},{"id":140,"depth":182,"text":143},{"id":155,"depth":176,"text":158},1790363498384]