# Cellular Security Arsenal: The Hacker's Playbook

**By W00t3k**

*Last Updated: March 2026*

---

## Table of Contents

1. [Introduction: The Digital Battlefield](#introduction)

2. [Getting Started: Building Your Foundation](#getting-started)

3. [Rogue Base Stations: Your Digital Weapons](#rogue-base-stations)

4. [Cutting-Edge Research: 2024-2025 Vulnerabilities](#cutting-edge-research)

5. [Essential Software Tools](#essential-software-tools)

6. [Hardware Options: Choose Your Weapon](#hardware-options)

7. [Attack Vectors: Unleashing Chaos](#attack-vectors)

8. [Advanced Topics: Beyond the Basics](#advanced-topics)

9. [Detection and Defense: Playing Both Sides](#detection-and-defense)

10. [Community Resources: Join the Network](#community-resources)

11. [Conclusion: Your Next Move](#conclusion)

---

## Introduction: The Digital Battlefield {#introduction}

Welcome to your personal arsenal for cellular warfare. This isn't some academic paper filled with theoretical nonsense. This is a practical, no-bullshit guide to breaking, bending, and understanding cellular networks. Whether you're a security researcher, a pentester, or just someone with an insatiable curiosity about how our mobile world really works, you've found the right place.

Cellular networks are the most pervasive surveillance infrastructure ever created. They track our movements, intercept our communications, and serve as the backbone of modern society. And they're riddled with vulnerabilities.

This playbook consolidates years of research, tools, and techniques into a single resource. Forget digging through dozens of repositories, academic papers, and forum posts—everything you need is right here.

---

## Getting Started: Building Your Foundation {#getting-started}

### Skill Levels & Required Equipment

#### Beginner: Passive Observation

- **Hardware**: RTL-SDR V3/V4 ($35-40) + Linux laptop

- **Software**: GNU Radio, GQRX, gr-gsm

- **First Project**: Passive GSM frame scanning with gr-gsm and Wireshark

- **Reading**: NIST SP 800-187 LTE Security Guide

#### Intermediate: Active Research

- **Hardware**: HackRF One/LimeSDR Mini ($139-350) + programmable SIMs

- **Software**: srsRAN 4G, Open5GS, OsmocomBB

- **First Project**: Private LTE network in a Faraday cage

- **Reading**: srsRAN documentation, Open5GS tutorials

#### Advanced: Protocol Warfare

- **Hardware**: USRP B210/BladeRF 2.0 + multiple test devices

- **Software**: 5GBaseChecker, LTEFuzz, BaseBridge, SigPloit

- **Focus**: Baseband fuzzing, RAN-Core interface testing, SS7/Diameter signaling

### Lab Setup Essentials

```bash

# USRP Installation on Linux

sudo add-apt-repository ppa:ettusresearch/uhd

sudo apt-get update

sudo apt-get install libuhd-dev libuhd003 uhd-host

uhd_find_devices

cd /usr/lib/uhd/utils/

./uhd_images_downloader.py

sudo uhd_usrp_probe

```

**Lab Setup Checklist**:

- Linux host (Ubuntu 22.04 or 24.04 recommended)

- UHD drivers installed and device recognized (uhd_find_devices)

- Faraday cage or RF shielding for active transmissions

- Programmable SIM cards (sysmoUSIM-SJA2 or similar)

- Dedicated test devices (not your daily driver)

- Isolated network environment (no production network access)

**Key Concepts to Understand First**:

- 3GPP Architecture Overview: how UE, eNodeB, MME, SGW, PGW fit together

- IMSI, IMEI, TMSI: subscriber identity fundamentals

- AKA Protocol: how authentication works in LTE

---

## Rogue Base Stations: Your Digital Weapons {#rogue-base-stations}

### GSM/CDMA Traffic Impersonation

#### How To Build Your Own Rogue GSM BTS For Fun and Profit

Guide to creating a portable GSM BTS for private networks or security testing. Covers technical setup using relatively inexpensive hardware.

#### How To Create an Evil LTE Twin / LTE Rogue BTS

Tutorial for setting up a 4G/LTE Evil Twin base station using srsRAN and USRP SDR devices.

#### Practical Attacks Against GSM Networks: Impersonation

Detailed analysis of GSM base station impersonation using SDR and open source tools.

#### Tutorial: Analyzing GSM with Airprobe and Wireshark

Step-by-step guide for using RTL-SDR to analyze GSM signals with GR-GSM/Airprobe and Wireshark.

#### GSM/GPRS Traffic Interception for Penetration Testing

NCC Group research on GSM/GPRS interception capabilities for penetration testing engagements.

---

## Cutting-Edge Research: 2024-2025 Vulnerabilities {#cutting-edge-research}

### Latest Vulnerabilities (2025)

#### RANsacked: 100+ Flaws in LTE and 5G Implementations

Researchers disclosed 119 vulnerabilities (97 CVEs) across seven LTE and three 5G implementations including Open5GS, Magma, OpenAirInterface, Athonet, SD-Core, srsRAN. Every flaw can be used to persistently disrupt city-wide cellular communications. Some require no SIM card — a single unauthenticated packet can crash an MME or AMF.

#### CITesting: Context Integrity Violations in LTE Core Networks

KAIST researchers identified a new class of uplink attacks against LTE core networks. Unlike traditional downlink attacks, these work through legitimate base stations and can affect anyone in the same MME coverage area. All four tested implementations (Open5GS, srsRAN, Amarisoft, Nokia) were vulnerable.

#### Uncovering Hidden Paths in 5G: Protocol Tunneling and Network Boundary Bridging

New research on exploiting protocol tunneling in 5G networks to cross network boundaries and reach components that should be isolated.

#### BaseBridge: Over-the-Air and Emulation Testing for Cellular Baseband Firmware

Bridges the gap between over-the-air and emulation-based testing for cellular baseband firmware analysis.

#### 5G Network Slicing: Security Challenges, Attack Vectors, and Mitigation

Comprehensive classification of attacks across orchestration, virtualization, and inter-slice communication layers in 5G.

### Updated Base Station Software

- **OpenBTS 2024 Reloaded**: Updated for modern UHD drivers and Ubuntu 22.04/24.04

- **OpenAirInterface (OAI)**: Complete 3GPP Release-15+ implementation with active 5G development

- **LimeNET CrowdCell**: Network-in-a-box with integrated LimeSDR for small cell deployments

- **Amarisoft LTEENB/gNB**: Professional-grade LTE/5G NR base station software

- **DragonOS**: Ubuntu-based SDR distro with cellular tools pre-installed

- **Magma Core Network**: Meta's distributed packet core, now under the Linux Foundation

- **5GBaseChecker**: Automated 5G baseband vulnerability detection tool

---

## Essential Software Tools {#essential-software-tools}

### Base Station Software

| Software | Description | Link |

|----------|-------------|------|

| OpenBTS (2024 Reloaded) | Updated Linux SDR-based GSM air interface | GitHub |

| OpenBTS (Original) | Range Networks implementation | SourceForge |

| YateBTS | GSM/GPRS radio access network implementation | Website |

| srsRAN Project | Open-source 5G O-RAN CU/DU software suite | GitHub |

| srsRAN 4G | Open-source 4G software radio suite | GitHub |

| OpenAirInterface | Complete 4G/5G protocol stack | Website |

| Free5GC | Open-source 5G core network implementation | GitHub |

| Kamailio | Open-source SIP server used in IMS/VoLTE labs | Website |

### Analysis Tools

- **LTE-Cell-Scanner**: LTE cell detection and analysis

- **gr-gsm**: GSM analysis with GNU Radio

- **IMSI-Catcher Detector**: Android app for detecting IMSI catchers

- **QCSuper**: Capture 2G-4G traffic using Qualcomm phones

- **5GBaseChecker**: Automated 5G baseband vulnerability detection (Penn State, 2024)

- **FALCON LTE**: Fast analysis of LTE control channels in real-time

- **Kalibrate**: GSM base station scanner and frequency calibration

- **LTE Sniffer**: Open-source LTE downlink/uplink eavesdropper

- **OsmocomBB**: Free firmware for mobile phone baseband processors

- **Modmobmap**: Mobile network mapping

- **Modmobjam**: Mobile jamming research tool

- **CITesting**: Systematic testing of context integrity violations in LTE core networks (KAIST, 2025)

- **SigPloit**: SS7/Diameter/GTP/SIP signaling security testing framework

- **LTEFuzz**: LTE protocol fuzzer from KAIST, predecessor to CITesting; generates malformed NAS/RRC messages

- **Crocodile Hunter**: EFF open-source tool for detecting rogue cell towers by wardriving

- **SCAT**: Signaling Collection and Analysis Tool; captures diagnostic logs from Qualcomm and Samsung # Cellular Security Arsenal: The Hacker's Playbook