ZERO TO 5G · DEF CON 34
Event Report
Telecom Village · Las Vegas · August 7–8, 2026
Hack a real 5G SA core · Two days
Reach · Both Days
101 people signed up to break a 5G core
Day 1 · Aug 7
Registered51
Workshop views422
Solved a challenge19
Flags captured66
Day 2 · Aug 8
Registered50
Workshop views436
Solved a challengen/a
Flags capturedn/a
CTF results in this report are from Day 1.
Workshop · Both Days
What people came to learn
858 page views across two days, weighted toward the technical sections.
Split roughly evenly across the two days — 422 views on Aug 7,
436 on Aug 8.
CTF Challenges · Day 1
Every challenge is a real attack path
CH1 · NRF Enumeration
19
100 pts
CH3 · Slice Census
14
150 pts
CH4 · Default Admin
12
200 pts
CH2 · Credential Theft
11
200 pts
CH5 · Subscriber Harvest
10
250 pts
66 flags captured ·
10 teams swept all five · every attack mapped to MITRE FiGHT
Leaderboard · Day 1
Ten perfect sweeps — ranked by speed
| # | Handle | Score | Challenges | Time |
|---|
| 1 | atom | 900 | | 36m 4s |
| 2 | kos | 900 | | 41m 45s |
| 3 | sandstorm | 900 | | 1h 10m |
| 4 | Luigi | 900 | | 1h 13m |
| 5 | uncountable | 900 | | 2h 23m |
| 6 | MrKilogram | 900 | | 2h 33m |
| 7 | lukashino | 900 | | 2h 33m |
| 8 | nickatee | 900 | | 3h 31m |
| 9 | mbrophy | 900 | | 3h 37m |
| 10 | strikeout | 900 | | 3h 47m |
Fastest full sweep: atom — 36 minutes, all five challenges.
The Story
Participants enumerated 5G service catalogs, exfiltrated raw subscriber keys,
discovered planted decoy network slices, exploited default management credentials,
and harvested subscriber identities — on a real Open5GS 5G SA core, not a simulator.
ZERO TO 5G · DEF CON 34
That's
a Wrap
A real 5G SA core, opened up to anyone who walked to the booth.
Thank you to everyone who showed up at Telecom Village.
Aug 7–8, 2026
Telecom Village · DEF CON 34
5 Challenges · 900 pts max