Your jumpbox runs a real Open5GS 5G SA core. Here's what's inside it — and where it breaks.
Open5GS5G SA CoreSBI / HTTP25 ChallengesBeginner Friendly
1
What Is the 5G Core?
The shift from monolithic to microservices
Before 5G, the carrier core was a monolithic system — a few big specialized boxes running proprietary protocols
like SS7 (2G/3G) and Diameter (4G). Every function (authentication, routing, subscriber data)
lived inside a single tightly-coupled platform. The 5G core ripped that apart. It runs as a set of independent
microservices called Network Functions (NFs) — each responsible for one job, talking to each other over
standard HTTP/2 REST APIs. This is the Service-Based Architecture (SBA): it looks a lot like a modern
cloud backend, because it is one. Which means its attack surface looks like one too.
Why this matters for the CTF: Because each NF exposes its own HTTP/2 API endpoint, an attacker
who can reach the core network (via WireGuard in this lab) can query those APIs directly — just like querying
any REST API. No special telecom tooling required. Just curl.
5G Core Network — Service-Based Architecture
Control Plane
Data Plane
Data Store
Management
Reading the diagram: The dashed horizontal line is the SBI bus — every NF registers with the NRF and
calls other NFs by discovering them there. The UPF sits below because it handles actual user data packets (not signaling).
MongoDB is the persistent store underneath UDR. The pulsing red rings mark the three NFs the CTF challenges target.
2
The NFs You'll Meet
Six network functions that matter for this CTF
The 5G core has a dozen NFs. For this CTF you only need to understand six. Here's what each one does and why it matters.
NRF
Network Repository Function
Service Registry & Discovery
The phone book for the entire 5G core. Every NF registers itself here on startup — its type, address, and
which APIs it offers. When an NF needs to call another, it asks the NRF for its location. Without NRF,
the core cannot function. Expose NRF to an attacker and they get a complete map of every NF on the network.
CH1 · CH3
UDR
Unified Data Repository
Subscriber Secret Store
The crown jewel. UDR stores every subscriber's authentication secrets: the permanent subscriber key K,
the operator constant OPc, the IMSI, and authentication vector data. In a production core
these are protected by access controls and HSM-backed encryption. In this lab the API returns them raw
as JSON — no authentication required.
CH2 · CH5
UDM
Unified Data Management
Subscriber Authentication Facade
UDM sits in front of UDR and provides a higher-level subscriber management API. When AMF needs to authenticate
a device, it calls UDM, which internally calls UDR to retrieve the K key and generates the authentication
vector. Attackers who bypass UDM and query UDR directly skip this indirection entirely.
AUSF
Authentication Server Function
5G-AKA Challenge Engine
AUSF runs the 5G Authentication and Key Agreement (5G-AKA) protocol. When a device tries to connect, AMF
calls AUSF, which calls UDM, which retrieves the K key from UDR. AUSF generates a cryptographic challenge
(RAND + AUTN) and verifies the device's response. If the K key is stolen from UDR, an attacker can
precompute valid authentication responses.
NSSF
Network Slice Selection Function
Slice Routing & Assignment
5G networks can be divided into "slices" — virtual networks for different use cases (IoT, eMBB, URLLC).
NSSF decides which slice a given device or session belongs to. Like all NFs, it registers with NRF.
The CTF hides a clue in NSSF's NRF registration record — specifically in its fqdn field.
CH3
WebUI
Open5GS Dashboard
Subscriber Management Interface
Open5GS ships a web-based management interface for adding subscribers, viewing registrations, and
configuring slices. It ships with a default credential set: admin / 1423. Once logged in,
the UI exposes the full MongoDB accounts collection — and a classic IDOR lets you enumerate
records by incrementing a numeric ID in the URL path.
CH4
3
How NFs Talk — The SBI
HTTP/2 REST, no TLS, no OAuth2 in the lab
In a production 5G deployment, NFs call each other using HTTP/2 REST APIs secured with
mutual TLS and OAuth2 tokens (defined in 3GPP TS 33.501). This is the
Service-Based Interface (SBI). Every API is versioned and documented by 3GPP. The NRF acts as both
registry and token issuer. In this lab, the Open5GS core runs with OAuth2 disabled and no TLS —
deliberate, for learning. That means the SBI is just plain HTTP/2 on the local network, queryable with curl.
HTTP/2 matters: You cannot use plain curl with these endpoints — curl defaults to HTTP/1.1,
which the Open5GS SBI server will reject with an error. You must pass --http2-prior-knowledge to force
HTTP/2 without a TLS upgrade handshake. This is the single most common mistake people make when first probing 5G core APIs.
Enumerate all registered NFs via NRFcurl--http2-prior-knowledge \
http://10.100.200.20:7777/nnrf-nfm/v1/nf-instances
URL Breakdown
--http2-prior-knowledge
Force HTTP/2 without TLS negotiation. Required — the NRF refuses HTTP/1.1.
http://10.100.200.20:7777
NRF's IP and port inside the 5G core network. No TLS — plain HTTP.
/nnrf-nfm/v1
nnrf = NRF service. nfm = NF Management interface. v1 = API version. 3GPP defines these paths.
/nf-instances
Returns a JSON array of every registered NF — their IDs, types, addresses, and metadata fields like fqdn.
What you get back: A JSON array of NF instance objects. Each has an nfInstanceId (UUID),
an nfType (AMF, SMF, UDR, CHF, etc.), and — crucially for CH1 and CH3 — an fqdn field
where certain NF registrations store the flag.
4
Where Trust Breaks
Production 5G vs. your lab
The 5G specifications (3GPP TS 33.501) define a robust security model. The Open5GS lab disables most of it
intentionally — that's the point of the exercise. Here's exactly what's missing.
🔒
Production 5G Core
TransportMutual TLS (mTLS)
NF AuthorizationOAuth2 access tokens
Subscriber keysHSM-protected, not in API
NRF accessToken-gated per NF type
WebUI credentialsCustom creds, MFA optional
Overall riskMinimal if deployed correctly
🔓
Your Lab (Open5GS)
TransportPlain HTTP (no TLS)
NF AuthorizationOAuth2 disabled
Subscriber keysRaw K key in JSON response
NRF accessOpen — any caller welcome
WebUI credentialsDefault: admin / 1423
Overall riskEvery NF API, zero auth
This is intentional. Open5GS in development mode disables authentication so operators can test
and debug without certificate management overhead. Real 5G deployments run with full mTLS and OAuth2.
The lab shows you what the spec protects by removing those protections — so you can see exactly
what an attacker can reach when they're absent.
5
Attack Surface Map
Five challenges, three NFs, zero authentication
Every CTF challenge maps to a specific NF and a specific API call. The table below is your
reconnaissance cheat sheet.
NF
What's Exposed
How to Reach It
Challenge
NRF
Unauthenticated enumeration of all registered NFs. CHF entry has an fqdn field containing the flag.
curl --http2-prior-knowledge to port 7777, path /nnrf-nfm/v1/nf-instances
CH1100 pts
UDR
Authentication subscription endpoint returns raw encPermanentKey (the K key) for any IMSI. No auth required.
Filter NRF by ?nf-type=NSSF. The NSSF registration entry contains a decoy fqdn with the flag embedded.
Same NRF endpoint with query param ?nf-type=NSSF, walk the JSON response
CH3150 pts
WebUI
Default credentials admin / 1423 grant full access. MongoDB accounts collection accessible via IDOR — increment ID in URL.
Browser to port 9999, login, navigate accounts collection
CH4200 pts
UDR
Same UDR authentication-subscription endpoint, different IMSI. Requires enumerating subscriber IMSIs in the known range.
Same UDR endpoint, iterate over the known IMSI prefix range
CH5250 pts
Flag format: All flags are TWIN{...}. You'll find them inside JSON field values,
fqdn strings, and database records — not printed on a screen. You have to read API output carefully.
6
Try It — Live API Simulator
Practice the exact commands you'll use against the real core
This simulator replays realistic Open5GS API responses. Type a command or click a quick button below.
Output matches what you'd see on a real jumpbox — flags use placeholder values, not the real ones.
jumpbox — 5G Core API Explorer● WG CONNECTED
user@jumpbox:~$
Quick Commands — click to run
On the real jumpbox these commands run exactly as shown — replace the placeholder IMSI and UUID
with values you discover during enumeration. The NRF is at 10.100.200.20:7777 and the UDR at
10.100.200.50:7777. You reach them over WireGuard.
You understand the architecture.
Now connect via WireGuard and attack a real one. Register to get your team's jumpbox credentials and VPN config.