/src/LTESniffer -A 2 -W -f -u -C -m 1 example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1 -u: uplink frequency" dir="auto">sudo .//src/LTESniffer -A 2 -W -f -u -C -m 1
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1
-u: uplink frequency Security API

/src/LTESniffer -A 2 -W -f -u -C -m 1 -z 3 example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1 -z 3 -z: 3 for turnning on 3 functions of sniffer, which are identity mapping, IMSI collecting, and UECapability profiling. 2 for UECapability profiling 1 for IMSI collecting 0 for identity mapping" dir="auto">sudo .//src/LTESniffer -A 2 -W -f -u -C -m 1 -z 3
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -C -m 1 -z 3
-z: 3 for turnning on 3 functions of sniffer, which are identity mapping, IMSI collecting, and UECapability profiling.
2 for UECapability profiling
1 for IMSI collecting
0 for identity mapping Specify a base station LTESniffer can sniff on a specific base station by using options -I -p . In this case, LTESniffer does not do the cell search but connects directly to the specified cell. /src/LTESniffer -A 2 -W -f -I -p -m 0 sudo .//src/LTESniffer -A 2 -W -f -u -I -p -m 1 example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -I 379 -p 100 -m 1" dir="auto">sudo .//src/LTESniffer -A 2 -W -f -I -p -m 0
sudo .//src/LTESniffer -A 2 -W -f -u -I -p -m 1
example: sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -u 1745e6 -I 379 -p 100 -m 1 The debug mode can be enabled by using option -d. In this case, the debug messages will be printed on the terminal. Output of LTESniffer LTESniffer provides pcap files (https://www.kitploit.com/search/label/Pcap%20Files) in the output. The pcap file can be opened by WireShark for further analysis and packet trace. The name of downlink pcap file: sniffer_dl_mode.pcap, uplink pcap file: sniffer_ul_mode.pcap, and API pcap file: api_collector.pcap. The pcap files are located in the same directory LTESniffer has been executed. To enable the WireShark to analyze the decoded packets correctly, please refer to the WireShark configuration guide here (https://github.com/SysSec-KAIST/LTESniffer/blob/main/pcap_file_example/README.md). There are also some examples of pcap files in the link.
Note: The uplink pcap file contains both uplink and downlink messages. On the WireShark, use this filter to monitor only uplink messages: mac-lte.direction == 0; or this filter to monitor only downlink messages: mac-lte.direction == 1. Application Note Distance for uplink sniffing The effective range for sniffing uplink is limited in LTESniffer due to the capability of the RF front-end of the hardware (i.e. SDR). The uplink signal power from UE is significantly weaker compared to the downlink signal because UE is a handheld device that optimizes battery usage, while the eNB uses sufficient power to cover a large area. To successfully capture the uplink traffic, LTESniffer can increase the strength of the signal power by i) being physically close to the UE, or ii) improving the signal reception capability with specialized hardware, such as a directional antenna, dedicated RF front-end, and signal amplifier. The information displayed on the terminal Downlink Sniffing Mode Processed 1000/1000 subframes: Number of subframes was processed by LTESniffer last 1 second. There are 1000 LTE subframes per second by design.
RNTI: Radio Network Temporary Identifier (https://www.kitploit.com/search/label/Identifier) of UEs.
Table: The maximum modulation scheme that is used by smartphones in downlink. LTESniffer supports up to 256QAM in the downlink. Refer to our paper (https://syssec.kaist.ac.kr/pub/2023/wisec2023_tuan.pdf) for more details.
Active: Number of detected messages of RNTIs.
Success: Number of successfully decoded messages over number of detected messages (Active).
New TX, ReTX, HARQ, Normal: Statistic of new messages and retransmitted messages. This function is in development.

W_MIMO, W_pinfor, Other: Number of messages with wrong radio configuration, only for debugging. Uplink Sniffing Mode Max Mod: The maximum modulation scheme that is used by smartphones in uplink. It can be 16/64/256QAM depending on the support of smartphones and the configuration of the network. Refer to our paper (https://syssec.kaist.ac.kr/pub/2023/wisec2023_tuan.pdf) for more details.
SNR: Signal-to-noise ratio (dB). Low SNR means the uplink signal quality from the smartphone is bad. One possible reason is the smartphone is far from the sniffer.
DL-UL_delay: The average of time delay between downlink signal from the base station and uplink signal from the smartphone.
Other Info: Information only for debugging. API Mode Detected Identity: The name of detected identity.
Value: The value of detected identity.
From Message: The name of the message that contains the detected identity. Credits We sincerely appreciate the FALCON (https://github.com/falkenber9/falcon) and SRS team (https://github.com/srsran/srsRAN_4G) for making their great softwares available. BibTex Please refer to our paper (https://syssec.kaist.ac.kr/pub/2023/wisec2023_tuan.pdf) for more details. @inproceedings{hoang:ltesniffer,
title = {{LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper}},
author = {Hoang, Dinh Tuan and Park, CheolJun and Son, Mincheol and Oh, Taekkyung and Bae, Sangwook and Ahn, Junho and Oh, BeomSeok and Kim, Yongdae},
booktitle = {16th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec '23)},
year = {2023}
} FAQ Q: Is it mandatory to use GPSDO with the USRP in order to run LTESniffer?
A: GPSDO is useful for more stable synchronization. However, for downlink sniffing mode, LTESniffer still can synchronize with the LTE signal to decode the packets without GPSDO. For uplink sniffing mode, GPSDO is only required when using 2 USRP B-series, as it is the time and clock reference sources for synchrozation between uplink and downlink channels. Another uplink SDR option, using a single USRP X310, does not require GPSDO. Q: For downlink traffic, can I use a cheaper SDR?
A: Technically, any SDRs supported by srsRAN library such as Blade RF can be used to run LTESniffer in the downlink sniffing mode. However, we only tested the downlink sniffing function of LTESniffer with USRP B210 and X310. Q: Is it illegal to use LTESniffer to sniff the LTE traffic?
A: You should have to check the local regulations on sniffing (unencrypted) LTE traffic. Another way to test LTESniffer is setting up a personal LTE network by using srsRAN (https://github.com/srsran/srsRAN_4G) - an open-source LTE implementation in a Faraday cage. Q: Can LTESniffer be used to view the content of messages between two users?
A: One can see only the "unencrypted" part of the messages. Note that the air traffic between the base station and users is mostly encrypted. Q: Is there any device identity exposed in plaintext in the LTE network?
A: Yes, literature shows that there are multiple identities exposed, such as TMSI, GUTI, IMSI, and RNTI. Please refer to the academic literature for more details. e.g. Watching the Watchers: Practical Video Identification Attack in LTE Networks (https://syssec.kaist.ac.kr/pub/2022/sec22summer_bae.pdf)

Download LTESniffer (https://github.com/SysSec-KAIST/LTESniffer)

23.4 Lab: User ID controlled by request parameter with data leakage in redirect | 2023

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response. To solve the…Continue reading on Medium »
Read more...

23.4 Lab: User ID controlled by request parameter with data leakage in redirect | 2023
https://cyberw1ng.medium.com/23-4-lab-user-id-controlled-by-request-parameter-with-data-leakage-in-redirect-2023-5fa1b18bced1?source=rss------bug_bounty-5

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response. To solve the…Continue reading on Medium » (https://cyberw1ng.medium.com/23-4-lab-user-id-controlled-by-request-parameter-with-data-leakage-in-redirect-2023-5fa1b18bced1?source=rss------bug_bounty-5)

How to find vulnerabilities in a web page in 10 minutes

Hi friends..Continue reading on Medium »
Read more...

How to find vulnerabilities in a web page in 10 minutes
https://medium.com/@l0calh0st/how-to-find-vulnerabilities-in-a-web-page-in-10-minutes-66cd052b4fbc?source=rss------bug_bounty-5

Hi friends..Continue reading on Medium » (https://medium.com/@l0calh0st/how-to-find-vulnerabilities-in-a-web-page-in-10-minutes-66cd052b4fbc?source=rss------bug_bounty-5)

Diving Deep: A Comprehensive Guide to Android Penetration Testing — Part 2

Preparing Your Ground: Setting Up for Android Penetration TestingContinue reading on Medium »
Read more...

Diving Deep: A Comprehensive Guide to Android Penetration Testing — Part 2
https://medium.com/@hackersdump0/diving-deep-a-comprehensive-guide-to-android-penetration-testing-part-2-9c33c319a696?source=rss------bug_bounty-5

Preparing Your Ground: Setting Up for Android Penetration TestingContinue reading on Medium » (https://medium.com/@hackersdump0/diving-deep-a-comprehensive-guide-to-android-penetration-testing-part-2-9c33c319a696?source=rss------bug_bounty-5)

Access control vulnerabilities

WEB SECURITY ACADEMY LABContinue reading on Medium »
Read more...

Access control vulnerabilities
https://medium.com/@abdullahwarsama28/access-control-vulnerabilities-02fe3ea2e17f?source=rss------bug_bounty-5

WEB SECURITY ACADEMY LABContinue reading on Medium » (https://medium.com/@abdullahwarsama28/access-control-vulnerabilities-02fe3ea2e17f?source=rss------bug_bounty-5)

ByteGuard: Mastering the Art of Data Security

In our increasingly digitized world, data has become a cornerstone of nearly every aspect of business and daily life. From personal…Continue reading on Medium »
Read more...