CH3 — Slice Census

Network slicing is one of 5G's defining architectural features. A single physical 5G core can be partitioned into multiple independent virtual networks — each with its own QoS guarantees, security policies, and subscriber base. A slice is identified by an S-NSSAI (Single Network Slice Selection Assistance Information), which contains an SST (Slice/Service Type) value and an optional SD (Slice Differentiator).

The NSSF (Network Slice Selection Function) is the function that knows about all slices and decides which slice a subscriber or session should be placed into. Every available slice is registered as a profile in the NSSF — and that registration is visible through the NRF. A decoy NSSF profile advertising a RESTRICTED internal slice (S-NSSAI sst=3) has been planted in this lab. Its identity is the flag.

In a production 5G deployment, only authorized Network Functions — identified by their OAuth2 client credentials and NF-type — may query the NRF for NSSF registrations or walk individual NSSF profiles. The NRF validates every request. In this lab, every query is accepted without any authorization check. An attacker with SBI network access can enumerate the full slice topology in two HTTP requests.

This challenge builds on CH1 (NRF enumeration). You query the NRF with a filter for nf-type=NSSF to get the list of registered NSSF instances, then fetch each profile individually by UUID. The planted decoy NSSF profile has the flag in its fqdn field.

In a production carrier 5G deployment, the NSSF knows about every slice — including those that operators would strongly prefer remain internal. An attacker who can enumerate the NSSF gains a detailed map of the operator's network architecture and customer commitments.

• 🔍
  Reveal private enterprise slices Large enterprises lease dedicated 5G slices for their own traffic — factory floors, campus networks, critical infrastructure. Enumerating the NSSF tells an attacker exactly which enterprises are on the network and what their slice identifiers are, enabling targeted attacks against specific tenants.
• 👮
  Identify law enforcement and government slices Emergency services, law enforcement intercept infrastructure, and government communication networks often run on dedicated 5G slices. Discovering their existence via NSSF enumeration is the first step toward targeting them — or specifically avoiding detection by operating around them.
• 🔨
  Map the operator's business relationships Every slice's S-NSSAI and associated FQDN reveals operator-customer relationships, service tier commitments, and internal network segmentation decisions. This is competitive intelligence an attacker could sell or use to craft more targeted social engineering campaigns.
• 🎯
  Enable targeted slice-specific attacks Knowing a slice exists and its identity allows an attacker to craft attacks specific to that slice — for example, registering rogue NFs that advertise support for the target slice's S-NSSAI, intercepting traffic for that specific slice's subscribers while ignoring the rest.