Practical Core network, Telecom Hacking

Day 1

Day 1 will introduce the mobile network and its evolution and compare the security features of 2G, 3G, 4G, and 5G. During this day, attendees will start going in depth on 2G core network security, and practical attacks with provided Virtual Machines.

Theory

• Introduction to mobile networks (2G/3G/4G/5G)
• Interfaces and protocols
• Channels
• Evolution
• Interconnections between providers
• Vectors of attacks inside and outside
• SS7 / SIGTRAN attacks and possibilities
• Current tools
• Security mechanisms

Assignment 1

• SS7 / SIGTRAN scanning
• Identifying interesting assets

Assignment 2

• Retrieving informations and secrets of subscribers

Assignment 3

• Retrieving locations
• Looking forward with further attacks

Assignment 4

• Retrieving information from the outside

Day 2

Days 2 will finish the 2G part and start talking about 3G core network and their similarities. After that, we will be able to proceed on 4G core network and attacks on DIAMETER.

Theory

• 3G network pentesting and similarity with 2G
• Interesting components in 3G
• DIAMETER security
• Tools to assess DIAMETER

Assignment 1

• Identifying external nodes (passively and actively)
• Attacking a node from the outside

Assignment 2

• Scanning for DIAMETER components
• Identifying interesting assets

Assignment 3

• Exploiting an identity theft attack

Assignment 4

• Exploiting an SMS theft attack

Assignment 5

• Intercepting traffic

Assignment 6

• Tracking the location of a subscriber

Assignment 7

• Going further with DoS, information gathering, etc.

Day 3

This final day will allow to go further and focus on new infrastructures we tend to see today and in the near future. We will talk and practice around Next-Generation Core Networks used in 5G, and see the changes and new skills that are required with the used interfaces when intruding a network. We will also see opportunities when it comes

Theory

• 5G NSA and SA
• New security mechanisms
• Attacking NGC functions
• Intruding the network from the outside
• The tools we have developed
• (Bonus) OpenRAN

Assignment 1

• Finish 4G attacks
• Intruding a 5G NSA network

Assignment 2

• Finding new opportunies
• Attacking the UPF

Assignment 3

• Identifying
• Attacking VNFs (leaks, exploitation, etc.)

Assignment 4

• Hijacking a network

Assignment 5: Bonus on RAN part

• Introduction to OpeRAN
• Attacking OpenRAN (depending on the time)

The content of private trainings can be arranged depending on your needs. We also provide additional content as follows:

• Practical 2G-5G security radio communication testing
• OpenRAN pentesting
• etc.

• Knowledge of administrating a Linux operating system is required
• Understanding of pentesting (network and applications) or Red teaming is also a plus
• All attendees must have a laptop running Linux, with 8GB of RAM min.
• Basic knowledge of radio in network security is a plus.

Training action within the meaning of article L. 6313-1 of the French Labour Code. Penthertz SAS is a training organisation registered under declaration number 11788588278 with the Île-de-France regional prefect; this registration does not constitute State approval.

Duration
21 hours over 3 days of 7 h. Indicative hours: 9:00–12:30 and 13:30–17:00.

Format
Live sessions, remote (virtual classroom) or on site, open enrolment or private group. Taught in English or French. 1 to 20 participants.

Audience
Pentesters, Red Team members, engineers and security teams of telecom operators and vendors.

Price
See the pricing table below: prices are shown excluding VAT (20 % in France), per participant for remote sessions; on-site and tailored content on quote.

Access time
Registration possible up to 10 working days before the session starts, subject to availability. The positioning questionnaire is sent to participants at least 15 days before the first day.

How to register
Contact us at [email protected] or through the contact form. A scoping call lets us collect your needs, check prerequisites and issue a quote. Registration is confirmed on receipt of the signed quote and training agreement.

Teaching methods
Short theory inputs followed by hands-on practice for most of the time, on targets and benches provided. Each participant works on their own workstation and equipment; kit, slides, scripts and captures are provided.

Assessment
Positioning questionnaire before the session; continuous assessment through observation of hands-on exercises and guided tasks; synthesis exercise at the end. Attendance is recorded on a half-day attendance sheet signed by participants and trainer.

Certificate
End-of-training certificate stating objectives, nature, duration and assessment results; completion certificate issued to the client. This course is not a certifying action (no RNCP or RS registration).

Accessibility
Our courses are accessible to people with disabilities. Contact our disability officer at [email protected] or +33 1 73 13 82 77, ideally 15 days before the session, to study adaptations. See our quality and accessibility page.

Documents
Training terms of sale (French original), training rules, privacy policy and results indicators. The detailed programme is the course content above; a PDF version is provided with the quote.

Complaints
Write to [email protected]: acknowledgement within five working days and a reasoned reply within fifteen working days. Individual customers may then refer an unresolved dispute free of charge to our consumer mediator, CM2C (details).

Information updated on 13 October 2026.