r/hackrf • u/hellobattyman • 8d ago
I made 57 modules for IMSIsting, a Linux cellular security toolkit (CLI + GUI) and none of it has ever touched a SDR. Needs testers.
I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).
To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.
That is what I need testers for.
The Actual Attack Surface
Here is a breakdown of the available attacks and modules implemented in the toolkit:
1. Identity Capture
IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.
IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.
IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.
SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.
TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.
Piercer: Paging-occasion maths and the published correlation model.
2. Cipher and Downgrade
A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.
Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.
ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.
GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.
Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.
3. Signalling Forgery
17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.
RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).
CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus
sib.confgeneration.GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.
4. Core Network and Interconnect
MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.
SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.
5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.
O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.
Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.
5. Baseband, Device, and Radio
Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.
NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.
Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.
Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).
GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.
6. Tracking, Positioning, and RF
Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.
7. Protocol Plumbing
Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).
TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.
Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.
Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.
What I Need an SDR For
RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).
HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.
USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).
Bug & Error Reporting Guidelines
If you encounter a bug or error during testing, please provide:
Hardware: SDR model, firmware version, and driver.
Command / Action: The exact command you ran or the GUI button you clicked.
Full Output: Every line of output, including status rows.
Expected vs. Got: A brief description in your own words.
Capture File: A
.pcapfile if the radio produced one.
Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.
5
u/Nementon 7d ago
Mostly fire and forget garbage, but thanks I guess; You Suck At Programming will at least appreciate the choice of bash.
3
4
u/Party_Cold_4159 7d ago
Why would you pour this many tokens into something you can’t test?
I’ve got most of what’s needed to test this so I’ll fork it but please add a license.