UERANSIM — 5G NR UE & gNodeB Emulator

UERANSIM is a high-performance open-source 5G SA Radio Access Network (RAN) and User Equipment (UE) simulator. In TelcoChisel, UERANSIM allows security researchers to simulate hundreds of rogue 5G UEs and fake gNodeBs without requiring physical RF hardware.

Key Security Audit Capabilities

• Simulated 5G UE Registration & NAS Security: Test 5G-GUTI allocation, AKA authentication, and NAS-5GS security mode command enforcement.
• Rogue gNodeB Injection: Establish unauthorized SCTP associations to test AMF admission control and NGAP malformed message handling.
• 5G PDU Session Establishment & Traffic Hijacking: Create uesimtun0 virtual network interfaces to send arbitrary TCP/UDP packets through 5G UPF data plane tunnels.
• Multi-UE Denial-of-Service Fuzzing: Spin up concurrent simulated UEs to stress-test 5G Core registration throttling and resource exhaustion.

TelcoChisel Cheatsheet

1. Start Simulated 5G gNodeB

# Start gNodeB connecting to local AMF at 127.0.0.1
sudo nr-gnb -c /etc/ueransim/open5gs-gnb.yaml

2. Connect Simulated 5G UE

# Launch UE with pre-configured SUPI, Key, and OPc
sudo nr-ue -c /etc/ueransim/open5gs-ue.yaml

3. Verify 5G Tunnel Data Plane (PDU Session)

# Ping external target via the simulated 5G tun interface
ping -I uesimtun0 8.8.8.8

Practice in TelcoSec Academy

👉 Access 5G UE & RAN Emulation Labs at App.TelcoSec.Net