IMSIsting

A GTK4 cellular security toolkit for Linux, with a full CLI behind it. Shell modules covering 2G/GSM, 3G/UMTS, 4G/LTE and 5G/NR, plus passive analysis over captures and per-generation CVE kits.

Every module is a standalone script. The GUI is a view over them, not a container — nothing is locked behind the interface.

Early development, and honest about it. No module in this tree has been run against a real radio. There is no SDR on the machine it was built on, so every over-the-air path is written and reviewed but not tested. The section What actually works says exactly which is which, and it is worth reading before you file a bug.

---

Why this exists

Cellular tooling is split by layer and by generation. gr-gsm is 2G. srsRAN is 4G/5G. Osmocom is the stack underneath. Wireshark dissects what you captured but will not capture it, and none of them share a target view.

This tree is wide on purpose: one desk, one launcher, one place where a cell survey, a NAS decode, a Diameter message and a cipher audit all land in the same TSV.

The other thing it does differently: most tools tell you they worked. This one is built to tell you when they didn't. Every module has a --selftest, the hardware-gated ones name the radio they are missing instead of returning an empty result, and a module that cannot do its job exits non-zero rather than reporting success.

---

Modules

Every row carries an attack status, and it is the honest one. The axis is not "does the module have an attack verb" — a verb that prints a plan file and a verb that prints protocol octets look identical in --help, and telling them apart is the whole point of this column. The axis is does it compute the attack's bytes.

Status	Meaning
built	It constructs the attack's protocol bytes for real and performs every step that is software. The radio or network hop is a named handoff (status: handoff, hardware named) — deliberate, per docs/MODULE_CONVENTIONS.md §9, not a gap.
built · TX	As built, and it also has a real transmit verb: the frame goes to an external command you supply (BEXP_TX_CMD / NRJ_TX_CMD), behind an armed guard.
partial	Some offensive verbs compute real bytes; others are prose, an arithmetic model, or a plan. The description says which.
plan	No offensive computation at all. The vector is a plan file naming the hardware or testbed it needs.
none	No offensive side, by design — decode, analysis, or defence. Not a gap; the module does not claim otherwise.

The long-form audit behind these verdicts, with a file:line for every classification, is in docs/OFFENSIVE-GAP-ANALYSIS.md.

System

Module	Description	Attack
00_deps	Inspect the cellular toolchain and install what is missing	none
01_radio	Enumerate SDRs, report per-band capability, record IQ	none
05_field_kit	RF pre-flight, honesty verification of every radio verb, synthetic GSMTAP source	none

Recon (passive)

Module	Description	Attack
02_cell_recon	Survey GSM/UMTS/LTE/NR cells; ARFCN and PLMN maths	none
03_gsmtap	Live GSMTAP over UDP, and offline decode of a GSMTAP capture	none
04_tower_map	GPS-tagged cell survey with CSV/KML/GeoJSON export	none

2G / GSM

Module	Description	Attack
06_gsm_air	BCCH/SI decode, paging analysis, cipher audit, A5/1 keystream	none
07_gsm_attack	IMSI catcher sequence, A5/1 downgrade, TMSI de-anonymisation	built

3G / UMTS

Module	Description	Attack
08_umts_air	UARFCN, SIB decode, RRC integrity (UIA), AKA relay analysis	none

08_umts_air is the honest hole in the tree. Every other generation has a rogue-base-station module: GSM has 07_gsm_attack, LTE has 09_lte_attach and 10_lte_air, NR has 12_nr_air. UMTS has a decoder and nothing else — no --forge-*, no encoder, no offensive verb of any kind. It is the only generation with no IMSI-catcher path, and the missing primitive is already sitting unused in the tree: 07_gsm_attack --f9-mac is KASUMI f9 (UIA1) verified against all three official TS 35.203 §5 vectors, and 08_umts_air --mac-input already emits the fields f9 consumes. Wiring them into a --forge-rrc is about thirty lines. It has not been done yet.

4G / LTE

Module	Description	Attack
09_lte_attach	NAS EMM/ESM encode-decode, BCD IMSI/IMEI, attach forge	built
10_lte_air	RRC/SIB decode, paging frame maths, srsRAN eNB orchestration	built
11_lte_core	Diameter S6a/S6d, GTP-C/GTP-U, S1-MME, EPC vectors	plan

10_lte_air writes both srsRAN configs and execs srsenb — a real rogue eNB, as far as software goes. 11_lte_core is the opposite case: four finished Diameter/GTP encoders that emit real octets, and until now no transport. --gtpc-send closes the GTP-C half through tools/udp_assoc.py — armed (LTE_ARMED=1), and honest about what a datagram proves: the report says sent and separately whether anything answered, because UDP has no acknowledgement and silence is not a delivery. --diameter-send closes the Diameter half through tools/stream_assoc.py: TCP 3868, TLS when LTE_DIAMETER_TLS=1, and verification on by default — an unverified peer is reported in as many words and is never the quiet default. No CER/CEA handshake is performed and no answer is matched to a request.

5G / NR

Module	Description	Attack
12_nr_air	NR-ARFCN, SSB/MIB/SIB1, RACH, gNB orchestration	built
13_nr_core	N2/N3/N4, SBA service bus, NGAP, PFCP, 5G-AKA	plan
14_suci	SUCI conceal/deconceal, ECIES profile A/B, HKDF, MSIN BCD	built
15_downgrade	Cross-generation steering, null cipher, reject-cause analysis	built

13_nr_core decodes NGAP/PFCP/GTP-U for real but every one of its four vectors is a plan file; there is no network client.

SIM

Module	Description	Attack
16_sim	ISO-7816 APDU, USIM files, OTA (TS 23.048), eSIM RSP	plan

16_sim builds a real ISO-7816 C-APDU and decodes OTA/IMSI/ICCID, but all four of its offensive paths — OTA replay to a UICC, programmable-SIM write, eSIM profile install, live APDU session — are status: handoff plan files. There is no PC/SC or CCID call and no APDU exchange loop in the module.

Analysis

Module	Description	Attack
17_pcap_analysis	pcap/pcapng dissection with a self-contained reader	none
18_imsi_exposure	Identity harvest, TMSI→IMSI correlation, exposure scoring	built
19_cipher_audit	Negotiated cipher scoring and downgrade detection	none

19_cipher_audit detects a downgrade; it does not perform one — there is no Security Mode Command injector and no A5/0 forcing anywhere in it.

Scanners

Module	Description	Attack
20_gsm_cve	2G/3G stack CVE kit, probe or handoff per id	plan
21_lte_cve	LTE stack CVE kit	plan
22_nr_cve	5G/NR and 5GC CVE kit	plan

All three CVE kits have the same contract: a probe (a fingerprint, capability check or config parse — it reports what it observed and never claims a device is exploitable) or a handoff. None of the three contains an exploit primitive — no GTP-C injector, no Diameter request builder, no HTTP/2 SBA client, no malformed-ASN.1 generator. 20_gsm_cve is worse than the other two on one point: its A5/1 and A5/2 "key recovery" verbs are threshold comparisons ((( seconds >= 120 )), (( frames < 4 ))), not recovery. Nothing recovers a key.