5G Core Service Based Interface (SBI) & SEPP Security Audit

5G SBIREST / HTTP/23GPP Rel-17

Overview & Audit Objective

In 5G Service-Based Architecture (SBA), Network Functions (NFs) communicate over HTTP/2 using JSON REST APIs. This playbook demonstrates how to validate 3GPP OpenAPI 3.0 schema compliance, audit OAuth2 token authorization, fuzz Service-Based Interfaces (NRF, AMF, UDM, AUSF), and analyze inter-PLMN roaming security at the Security Edge Protection Proxy (SEPP / N32).

Execution Steps

1
Check 5G SBI & Schema Status:
Confirm that 3GPP Release 16/17/18 OpenAPI definitions are loaded into the local system:
Terminal — Check SBI Specs
```
telcosec sbi status
```
2
Validate OpenAPI 3.0 Contract Compliance:
Verify that target 5G Core REST endpoints strictly conform to standard 3GPP JSON specifications:
Terminal — Validate SBI Contract
```
telcosec sbi validate http://127.0.0.1:7777 nrf
```
3
Launch Mutational REST API Fuzzer:
Send mutated JSON payloads, header injections, and token bypass sequences against the target NF:
Terminal — Fuzz SBI Endpoints
```
telcosec sbi fuzz http://127.0.0.1:7777 amf
```
4
Intercept & Modify SBI Traffic with mitmproxy:
Run interactive HTTP/2 interception proxy to tamper with live NF discovery responses:
Terminal — mitmproxy Interception
```
mitmproxy --listen-port 8080 --mode reverse:http://127.0.0.1:7777
```

Evidence & Artifact Archiving

Export all HTTP/2 transaction PCAPs and fuzzer anomaly reports into a signed archive:

Terminal — Bundle Evidence

telcosec bundle-evidence 5g-sbi-audit