SS7MAPer — SS7 MAP Reconnaissance & Network Scanner

SS7MAPer is an automated reconnaissance and network topology mapping engine for telecom SS7/SIGTRAN signaling backbones. It probes target carrier Global Titles (GT) and Point Codes (PC) to discover active HLRs, MSCs, VLRs, and SMSCs while testing MAP protocol message filtering rules.

Core Telecom Vectors

• Global Title Scanning & Resolution: Discover active network nodes across target Mobile Country Codes (MCC) and Mobile Network Codes (MNC).
• MAP Operation Probing: Test whether target carrier nodes respond to unauthorized MAP messages (SendRoutingInfo, AnyTimeInterrogation, ProvideSubscriberInfo).
• Signaling Firewall Fingerprinting: Identify and classify carrier SMS/MAP firewalls and SMS Routers.

Cheatsheet

1. Scan Carrier Global Title Range

# Scan a range of GTs to identify active HLR / VLR nodes
python3 /opt/ss7maper/ss7maper.py -r 33600000000-33600000100 --op SRI_SM

2. Fingerprint HLR Response Behavior

# Send targeted SRI_SM query to check for subscriber IMSI exposure
python3 /opt/ss7maper/ss7maper.py -t 447700900000 --imsi-probe

Practice in TelcoSec Academy

👉 Launch SS7 Attack & Reconnaissance Labs on App.TelcoSec.Net