Workshop Module · Section 2 · MAP / ATI · Cell-ID Location
Subscriber Profile & Location
With an IMSI in hand, what can you learn? Query a subscriber's full profile over SS7 MAP, then geolocate a device using network signaling — no GPS, no cooperation from the target.
Topics covered in this section
Coming soon
Get Subscriber Profile
Use the SS7 MAP Any-Time-Interrogation (ATI) command to pull a subscriber's full profile from the HLR — roaming status, IMEI, subscriber state, and more — using only their IMSI.
MAP-ATI
HLR query
Subscriber state
IMEI disclosure
Coming soon
Get Location of Device
Translate a network response into physical coordinates. Learn how Cell-ID and timing advance values can be combined with public cell tower databases to estimate a target's location in real time.
Cell-ID
MAP-PSI
Geolocation
Tower databases
Prerequisites — complete Section 1 first
- Know the difference between MSISDN (public phone number) and IMSI (internal subscriber identity)
- Understand how MAP-SRI resolves a phone number to an IMSI via the HLR
- Be comfortable with the
sigtran-shellCLI used in the lab environment