5G NR & LTE Over-The-Air Fuzzing with 5Ghoul

5G NRUSRP / BladeRFOTA Ready

Overview & Audit Objective

5Ghoul is an automated over-the-air (OTA) fuzzing framework designed to uncover vulnerabilities and zero-day exploits in commercial 5G modems, smartphones, IoT modules, and routers. This playbook details how to configure RF transceivers (Ettus USRP or Nuand BladeRF), execute 5G NAS/RRC fuzzing campaigns, and detect baseband crashes.

Execution Steps

1
Verify SDR Radio Hardware & Latency:
Confirm the transceiver is enumerated and kernel parameters are tuned for low latency:
Terminal — Hardware Verification
```
telcosec doctor
sudo telcosec-profile set lab
```
2
Build / Verify 5Ghoul Framework:
Run the first-run installation helper for your specific radio frontend (USRP or BladeRF):
Terminal — 5Ghoul Setup
```
sudo 5ghoul-install --radio USRP
```
3
Launch 5G NAS & RRC Mutation Campaign:
Start the Rogue gNB transmitter targeting nearby test UEs in a shielded RF enclosure / Faraday cage:
Terminal — Launch Fuzzer
```
sudo 5ghoul-run --Attack.Name=NAS_5GS_Fuzz --Radio=USRP
```
4
Monitor Crash Signals & Re-registration:
Observe the live diagnostic console for UE disconnections, memory faults, and radio link failures (RLF):
Terminal — Monitor Logs
```
tail -f /var/log/5ghoul/fuzzer.log
```

Evidence & Artifact Archiving

Archive the fuzzing payload seeds, mutation logs, and capture files:

Terminal — Bundle Evidence

telcosec bundle-evidence 5ghoul-campaign