Back to Products
Complete Cellular Intelligence

CELLSIGINT

THE ULTIMATE CELLULAR HUNT

2G GSM 3G UMTS 4G LTE 5G NR mmWave

From GSM 850 to 5G FR2 mmWave. Extract IMSI in <50ms. Crack A5/1 with 90%+ success. Classify 35+ signal types with ML. Triangulate with WebRTC mesh. One tool. Every generation. Complete visibility.

<50ms
IMSI Extraction
90%+
A5/1 Recovery
35+
Signal Types
2TB
Rainbow Tables
Deploy CELLSIGINT See Capabilities
Rust Core
18,500 LoC
WebRTC Mesh
ML Classification
Rainbow Tables

Protocol Support Matrix

Complete cellular spectrum coverage from legacy 2G to cutting-edge 5G mmWave

2G

GSM

IMSI, TAC, EARFCN extraction. A5/1 rainbow attacks.

Production
2.5G

GPRS/EDGE

TLLI extraction. GEA cipher analysis.

Production
3G

UMTS

IMSI extraction. Limited attack surface.

Beta
4G

LTE

GUTI, TAC extraction. MIB/SIB/NAS decode.

Production
5G

NR FR1

5G-GUTI extraction. Sub-6GHz coverage.

Production
5G

NR FR2

mmWave 24-52 GHz. Requires wideband SDR.

Beta
Core

SS7/MAP

MSISDN extraction. Location queries.

Production
Core

GTP-C

APN extraction. Subscriber tracking.

Production
ISM

WiFi/BT

802.11, Bluetooth, ZigBee analysis.

Production
IoT

LoRa/SigFox

LPWAN signal detection and decode.

Beta

Intelligence Capabilities

From RF capture to identity extraction

Signal Intelligence

  • Complete 2G-5G protocol stack decode
  • Enhanced cell parameters (TAC, EARFCN, NR-ARFCN)
  • Timing advance and C/I ratio analysis
  • ISM band analysis (WiFi, BT, ZigBee)

Cipher Analysis

  • A5/1 rainbow table attacks (2TB full keyspace)
  • A5/2 known weakness exploitation
  • COMP128 SIM authentication analysis
  • Kc session key extraction

ML Classification

  • 35+ signal type classification
  • BPSK to 256QAM modulation recognition
  • Anomaly detection with baseline deviation
  • Protocol fingerprinting for vendor detection

Distributed Operations

  • WebRTC mesh with NAT traversal
  • Multi-node cell triangulation
  • Coordinated capture synchronization
  • Sub-millisecond time alignment

A5/1 Rainbow Table Attack

Real-time GSM cipher key recovery using precomputed rainbow tables. The A5/1 stream cipher has known cryptographic weaknesses that allow practical key recovery in under 2 seconds with full keyspace coverage.

2TB
Table Size
<2s
Lookup Time
>90%
Success Rate
64-bit
Keyspace
A5/1 KEY RECOVERY FLOW CAPTURE GSM Burst EXTRACT Keystream bits LOOKUP 2TB Tables RAINBOW TABLE (2TB) 0x7A3B... Kc: 0x4F2A... MATCH Kc RECOVERED

Hardware Compatibility

From $30 RTL-SDR to enterprise-grade USRP

RTL-SDR v4

2.4 MHz BW | 24-1766 MHz
GSM LTE 5G

HackRF One

20 MHz BW | 1-6000 MHz | TX
GSM LTE 5G FR1

USRP B210

56 MHz BW | 70-6000 MHz | TX
GSM LTE 5G FR1

LimeSDR

61 MHz BW | 100kHz-3.8GHz | TX
GSM LTE 5G FR1

USRP X310

160 MHz BW | 10MHz-6GHz | TX
GSM LTE 5G FR1

Sivers IMA EVK

400 MHz BW | 24-30 GHz | TX
GSM LTE 5G FR2

Core Features

18,500 lines of battle-tested Rust

Identity Extraction

IMSI, TMSI, GUTI, 5G-GUTI, MSISDN, IMEI. Complete subscriber identity capture across all generations.

Multi-SDR Sync

Synchronized capture across multiple SDR devices. GPS-disciplined timing for coordinated operations.

WebRTC P2P Mesh

NAT-traversing peer-to-peer network for distributed operations. DTLS encryption. SCTP data channels.

Cell Triangulation

Multi-node geolocation with configurable accuracy. RTK GPS support for sub-meter positioning.

Real-time Dashboard

Terminal UI with live signal visualization. REST API and WebSocket for integration.

SQLite + TimeSeries

Persistent storage with time-series optimization. Fast queries across millions of captures.

Mission Profiles

Authorized security research and defense applications

Security Research

Protocol vulnerability analysis in controlled lab environments. Academic research on cellular security. CVE discovery and responsible disclosure.

Penetration Testing

Authorized red team engagements. Cellular infrastructure assessment. IMSI catcher detection and countermeasures testing.

Defensive Security

Rogue base station detection. Corporate facility monitoring. Counter-surveillance and TSCM operations.

Education & Training

Telecommunications curriculum. Security awareness training. Hands-on protocol analysis labs.

LEGAL NOTICE: Unauthorized interception of cellular communications is ILLEGAL in most jurisdictions. This software is provided for authorized security research, penetration testing, and educational purposes only. Users must comply with all applicable laws.

Ready for Complete Cellular Visibility?

From 2G to 5G mmWave. One platform. Total awareness.

Hardware kits available
Rainbow table packages
Training & certification
Enterprise support
Contact Sales Request Documentation