5G Standalone (SA) Core & gNB Security Audit

5G SACore NetworkLab Ready

Overview & Audit Objective

This playbook provides an end-to-end workflow for auditing 5G Standalone (SA) networks using Open5GS and UERANSIM. Operators and penetration testers can emulate a complete 5G Service-Based Architecture (SBA), analyze NGAP signaling, intercept Service-Based Interface (SBI) REST communications over HTTP/2, and test NAS encryption enforcement.

Execution Steps

1
Initialize Open5GS 5G SA Core:
Start the containerized or native Open5GS core network daemons (AMF, SMF, UPF, NRF, UDR, AUSF):
Terminal — Start 5G Core
```
sudo open5gs-install
sudo telcosec 5g-sa start
```
2
Register Test Subscriber:
Add a simulated SIM subscription with Milenage authentication keys (K, OPc):
Terminal — Provision Subscriber
```
sudo telcosec 5g-sa add-sub 999700000000001 465B5CE8B199B49FAA5F0A2EE238A6BC E8ED289DEBA952E4283B54E88E6183CA
```
3
Simulate 5G NR gNB & UE:
Launch UERANSIM gNB and attach the virtual User Equipment to establish a PDU session:
Terminal — Start gNB & UE
```
nr-gnb -c /etc/telcosec/ueransim/gnb.yaml &
nr-ue -c /etc/telcosec/ueransim/ue.yaml
```
4
Capture & Analyze SBI Traffic:
Inspect unencrypted or TLS-intercepted 5G SBI HTTP/2 REST APIs via Wireshark:
Terminal — Wireshark SBI Analysis
```
wireshark -k -i lo -f "tcp port 7777 or tcp port 8000" &
```

Evidence & Artifact Archiving

Export all PCAP captures and core network logs into a signed bundle upon completing the audit:

Terminal — Evidence Capture

telcosec bundle-evidence 5g-sa-audit