INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · OPEN5GS
Open5GS — 5G Core Network Security Testing & Protocol Research
Research Overview
TL;DR — Open5GS is a complete open-source implementation of the 3GPP 5G Core Network (5GC) per TS 23.501 and the 4G Evolved Packet Core (EPC). It includes AMF, SMF, UPF, AUSF, UDM, PCF, NSSF, NRF, SEPP, SCP, and EPC nodes (MME, SGW, PGW, HSS). Security researchers deploy Open5GS with srsRAN to test 5G-AKA and EAP-AKA' authentication flows, audit Service-Based Architecture HTTP/2 NF interfaces for injection vulnerabilities, evaluate SEPP N32 inter-PLMN roaming security per GSMA FS.20, and research GTP-U/PFCP user-plane security in 5G core deployments.
Open5GS implements the full 3GPP 5G Core (5GC) network function set as defined in TS 23.501 and TS 23.502, including AMF, SMF, UPF, AUSF, UDM, PCF, NSSF, NRF, SEPP, and SCP. Each network function exposes a Service-Based Interface (SBI) over HTTP/2 with JSON-encoded schemas defined in the 3GPP TS 29.5xx series, making Open5GS a complete target for 5G core API security research. The EPC stack (MME, SGW-C/U, PGW-C/U, HSS) is also included for 4G/5G Non-Standalone and LTE-interoperability testing scenarios.
Security researchers deploy Open5GS with srsRAN gNodeB to construct complete 5G SA or NSA testbeds, then instrument the SBI interfaces to inject malformed HTTP/2 requests targeting individual NF implementations. The AMF and AUSF are primary targets for 5G-AKA (TS 33.501 Section 6.1) and EAP-AKA' (Section 6.2) authentication flow testing, including XRES* replay attacks, MAC failure handling, and RAND reuse scenarios. The UDM's Nudm_UEAuthentication and Nudm_SDM interfaces are probed for unauthorised subscriber data disclosure across the N12 and N13 reference points.
Roaming security testing leverages Open5GS's SEPP implementation, which handles inter-PLMN N32 interface protection using JWS and JWE as defined in TS 33.501 Annex E and TS 29.573. Researchers test N32-f message forwarding manipulation, PLMN topology hiding bypass, and IPX-mediated message modification attacks analogous to legacy GTP-C roaming vulnerabilities. The UPF implements PFCP (Packet Forwarding Control Protocol, TS 29.244) for N4 interface control, enabling GTP-U tunnel manipulation and user-plane bypass research. DNS-based 5G NF discovery attack surface via NRF registration queries can be mapped using RDNSx.
Key Research Applications
- >Deploy full 5G SA core (AMF/SMF/UPF/AUSF/UDM/NRF) with srsRAN gNodeB for end-to-end 5G-AKA and EAP-AKA' authentication flow testing including vector replay and MAC failure injection per 3GPP TS 33.501
- >Test 5G SBA NF interfaces for HTTP/2 injection, NSSAI manipulation, and unauthorised NRF registration attacks across N8/N10/N11/N12 reference points
- >Evaluate SEPP N32 inter-PLMN interface security including JWS/JWE message protection, PLMN topology hiding effectiveness, and roaming IPX manipulation scenarios per GSMA FS.20
- >Instrument PFCP N4 interface between SMF and UPF for GTP-U injection, PDU session binding attacks, and traffic steering manipulation in 5G user-plane security assessments
Technical Specifications
Operational Mode
Level 3 certification required. Targeting Core Network infrastructure layers.
Compatibility
Standard Linux environment with kernel-level protocol stacks.
Secure Audit Threat Vectors
The 5G Service-Based Architecture's reliance on HTTP/2 and REST APIs introduces web-application-class vulnerabilities into core network functions. Open5GS testing has surfaced insufficient input validation on SUCI decryption endpoints, NSSAI injection vectors in Nausf_UEAuthentication requests, and AMF session context confusion through malformed 5G-GUTI reallocation sequences. The NRF (TS 29.510) service registry is a high-value target: unauthorised NF registration or profile manipulation can redirect core traffic to adversary-controlled network functions, a threat categorised under GSMA FS.20 (5G Roaming Security Guidelines).
GTP-U tunnelling through the UPF on N3 and N9 interfaces inherits legacy vulnerabilities from 4G: absent source address validation enables GTP-U packet injection into established PDU sessions, enabling user-plane data interception or session hijacking. The PFCP N4 interface between SMF and UPF, if exposed without mutual TLS per TS 29.244 Section 5.2, is susceptible to rogue UPF registration and traffic steering manipulation. Inter-PLMN roaming via SEPP and IPX introduces a partially-trusted intermediary model where subscriber data transits third-party infrastructure, creating disclosure risks documented in GSMA IR.88 and FS.19.
Frequently Asked Questions
What is Open5GS — 5G Core Network?
Open5GS — 5G Core Network is an open-source telecom security utility in the Core Network category. Open5GS is a complete open-source implementation of the 3GPP 5G Core Network (5GC) per TS 23.501 and the 4G Evolved Packet Core (EPC). It includes AMF, SMF, UPF, AUSF, UDM, PCF, NSSF, NRF, SEPP, SCP, and EPC nodes (MME, SGW, PGW, HSS). Security researchers deploy Open5GS with srsRAN to test 5G-AKA and EAP-AKA' authentication flows, audit Service-Based Architecture HTTP/2 NF interfaces for injection vulnerabilities, evaluate SEPP N32 inter-PLMN roaming security per GSMA FS.20, and research GTP-U/PFCP user-plane security in 5G core deployments.
Which category does Open5GS — 5G Core Network belong to?
Open5GS — 5G Core Network is categorized under Core Network in the TelcoSec Tools console. This category covers tools used for auditing telecom security architecture including DNS, signaling protocols, and firmware vulnerability research.
How does Open5GS handle 5G authentication compared to 4G EPS-AKA?
Open5GS implements both 5G-AKA and EAP-AKA' as defined in 3GPP TS 33.501. 5G-AKA introduces XRES* (a hashed expected response) in place of EPS-AKA's XRES, binding authentication confirmation to the serving network and preventing XRES replay across PLMNs. The AUSF stores XRES* and validates the RES* received from the AMF, adding a serving-network confirmation step absent in 4G. Open5GS's UDM generates authentication vectors using the Milenage or TUAK algorithms (TS 35.205, TS 35.231), configurable per subscriber in the HSS/UDM database.
Can Open5GS be used to test 5G roaming security vulnerabilities?
Yes. Open5GS includes a SEPP implementation for N32 inter-PLMN interface testing per TS 29.573 and TS 33.501 Annex E. Deploying two Open5GS instances representing HPLMN and VPLMN connected via a simulated IPX allows researchers to test N32-f message integrity, PLMN identity validation, subscriber data protection in Nudm_SDM responses, and topology hiding effectiveness. This replicates the attack surface described in GSMA FS.20 and mirrors historical GTP-era roaming attacks now transitioned to HTTP/2 SBI in 5G core network deployments.
ADVANCED_TRAININGCore Network Security PathRecommended for: Open5GS — 5G Core Network
Master Open5GS — 5G Core Network Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about Open5GS — 5G Core Network? Send it directly to the research team.