5Ghoul Fuzzer Wrapper

Core Network & SignalingSetup RequiredLocation: /usr/local/bin/5ghoul-run

Command Line Execution

Run this command in the TelcoChisel terminal to launch or execute the tool:

5Ghoul Fuzzer Wrapper Command
sudo 5ghoul-run --Attack.Name=NAS_5GS_Fuzz

Detailed Technical Overview

5Ghoul is a security fuzzer targeting 5G NR baseband modems. It implements an OpenAirInterface (OAI) rogue base station to inject malformed RRC and NAS signaling packets over the air, revealing memory corruption and crash bugs in cellular devices.

Configuration & Usage Guide

To initialize and configure 5Ghoul Fuzzer Wrapper for telecom security audits, follow these steps:

  1. 1Run the installer to pull and compile dependencies: sudo 5ghoul-install --radio BLADERF
  2. 2Add your target IMSI to the Open5GS subscriber database: sudo 5ghoul-add-subscriber
  3. 3Launch the fuzzer engine: sudo 5ghoul-run --Attack.Name=NAS_5GS_Fuzz

Troubleshooting & Security Audits

5Ghoul Fuzzer Wrapper Audit Warning
Running inside a VM causes USB timing jitter, which interrupts 5G NR signal sync. Use bare metal hardware.
SIGNALING CORE LAB

Master 5Ghoul Fuzzer Wrapper with Interactive Telecom Labs

Practice deploying 5Ghoul Fuzzer Wrapper against live cellular networks, radio interfaces, and mobile cores in TelcoSec Academy's browser-accessible cloud sandboxes.

Interactive Cloud Labs No Hardware Required CTSP Certification
Launch Interactive Labapp.telcosec.net · Instant access

Frequently Asked Questions

What radios are compatible?

Ettus USRP B210 and Nuand BladeRF micro xA4 are fully supported.

How long does compilation take?

Compiling the patched OpenAirInterface code takes 20-40 minutes on first execution.

Back to Tools Directory