A Scapy implementation of SMS-SUBMIT and (U)SIM Application Toolkit command packets.

Related tags

Networking sms scapy
Overview

ScapySMS

A Scapy implementation of SMS-SUBMIT and (U)SIM Application Toolkit command packets.

This framework is designed to assist with fuzzing SIM card applications and, more generally, SMS systems as a whole. Because this project uses the Scapy framework, it's possible to have control over the entire packet. This was the key feature that inspired the creation of this project.

Functionality for sending SMS messages via AT commands to a modem is also included.

How to use

It is nearly impossible to use this framework without having the GSM specification side by side as a reference. Some notes on the relevant GSM documents can be found in the scapysms.py file itself. Though you'll probably want to start here:

Building a SMS-SUBMIT PDU

import scapysms

sms = scapysms.SMSSubmit()
sms.TP_RP = 0
sms.TP_UDHI = 0
sms.TP_SRR = 0
sms.TP_VPF = 10
sms.TP_RD = 0
sms.TP_MTI = 1
sms.TP_MR = 0

myaddr = scapysms.Address()
myaddr.Type_of_number = 1 # International format, includes country code
myaddr.Digits = '15558675309'
sms.TP_DA = myaddr

sms.TP_PID = 0
sms.TP_DCS = 8 # UTF-16
sms.TP_VP = b'\x00' # 5 minutes
sms.TP_UD = 'Hello world ✌️'.encode('utf-16')
sms.show2()

print('PDU hex: {}'.format(bytes(sms).hex()))
###[ SMS-SUBMIT ]### 
  TP_RP     = 0: TP-Reply-Path parameter is not set in this SMS-SUBMIT/DELIVER
  TP_UDHI   = 0: The TP-UD field contains only the short message
  TP_SRR    = 0
  TP_VPF    = 10: Relative format
  TP_RD     = 0
  TP_MTI    = 1
  TP_MR     = 0
  \TP_DA     \
   |###[ Address ]### 
   |  Length    = 11
   |  Extension = No extension
   |  Type_of_number= International number
   |  Numbering_plan= ISDN/telephone numbering plan (E.164/E.163)
   |  Digits    = 15558675309
  TP_PID    = 0
  TP_DCS    = 8
  TP_VP     = 00
  TP_UDL    = 30
  TP_UD     = fffe480065006c006c006f00200077006f0072006c00640020000c270ffe

PDU hex: 11000b915155685703f90008001efffe480065006c006c006f00200077006f0072006c00640020000c270ffe

Sending a SMS to a modem

m = scapysms.Modem('/dev/ttyUSB2')
m.sendPDU(sms)

(U)SIM Application Toolkit command packets

I don't have any good examples to show here, but you can decode a packet from hex like this:

bytes = bytes.fromhex(yourhex)
p = scapysms.CommandPacket(bytes)
p.show2()

Testbed suggestions

I recommend checking out the QCSuper project. Paired with the right Qualcomm USB modem / Android phone you can use this to create GSM packet captures. This is extremely helpful for seeing how data is sent out from your modem, as well as seeing what the data looks like when it's received.

Learn more

Adaptive Mobile's Simjacker technical report is a good practical example of what can be found when digging into these old technologies.

Also:

You might also like...
A Python based command line ARP Spoofer utility, which takes input as arguments for the exact target IP and gateway IP for which you wish to Spoof ARP request

A Python based command line ARP Spoofer utility, which takes input as arguments for the exact target IP and gateway IP for which you wish to Spoof ARP request

This application aims to read all wifi passwords and visualizes the  complexity in graph formation by taking into account several criteria and help you generate new random passwords.
This application aims to read all wifi passwords and visualizes the complexity in graph formation by taking into account several criteria and help you generate new random passwords.

This application aims to read all wifi passwords and visualizes the complexity in graph formation by taking into account several criteria and help you generate new random passwords.

A simple, configurable application and set of services to monitor multiple raspberry pi's on a network.
A simple, configurable application and set of services to monitor multiple raspberry pi's on a network.

rpi-info-monitor A simple, configurable application and set of services to monitor multiple raspberry pi's on a network. It can be used in a terminal

 sync application configuration and settings across multiple multiplatform devices
sync application configuration and settings across multiple multiplatform devices

sync application configuration and settings across multiple multiplatform devices ✨ Key Features • ⚗️ Installation • 📑 How To Use • 🤔 FAQ • 🛠️ Setu

Simple P2P application for sending files over open and forwarded network ports.

FileShareV2 A major overhaul to the V1 (now deprecated) FileShare application. V2 brings major improvements in both UI and performance. V2 is now base

GhostVPN - Simple and lightweight TUI application for CyberGhostVPN
GhostVPN - Simple and lightweight TUI application for CyberGhostVPN

GhostVPN Simple and lightweight TUI application for CyberGhostVPN. Screenshot Us

Using AWS's API Gateway + Lambda + Python to run a simple websocket application. For learning/testing
Using AWS's API Gateway + Lambda + Python to run a simple websocket application. For learning/testing

Using AWS's API Gateway + Lambda + Python to run a simple websocket application. For learning/testing. The AWS Resources seemed overly complex and were missing some critical gotchas in setting up a system like this.

Desktop application for checking sites connection in a background mode
Desktop application for checking sites connection in a background mode

Site connectivity checker Desktop application for checking site connection in a background mode by sending ICMP messages. Problem and solution Usually

Tiny Interactive File Transfer Application

TIFTA: Tiny Interactive File Transfer Application This repository holds all the source code, tests and documentation of the TIFTA software. The main g

Owner
mnemonic
mnemonic - Defining cybersecurity
mnemonic
A Python library to ease the integration with the Beem Africa (SMS, AIRTIME, OTP, 2WAY-SMS, BPAY, USSD)

python-client A Python library to easy the integration with the Beem Africa SMS Gateway Features to be Implemented Airtime OTP SMS Two way SMS USSD Bp

Beem Africa 24 Oct 29, 2022
Flashes keyboard leds on incoming/outgoing network packets

LED Net Capture Flashes keyboard leds on incoming/outgoing network packets Usage Requires root priviledges to run usage: ledcapture.py [-h] --keyboard

Dan Habot 56 Oct 27, 2022
Multi-path load balancing is a method used by most of the real-time network to split the packets into different paths rather than transferring it through a single path

Multipath-Load-Balancing Method of managing incoming traffic by distributing and sharing load fairly among multiple routes from source to destination

Dharshan Kumar 6 Dec 10, 2022
(A)sync client for sms.ru with pydantic responses

?? aioSMSru Send SMS Check SMS status Get SMS cost Get balance Get limit Get free limit Get my senders Check login/password Add to stoplist Remove fro

Eugene Mayer 4 Jul 3, 2022
A Cheap Flight Alert program sends you a SMS to notify cheap flights in next 8 months.

Flight Dealer A Cheap Flight Alert program sends you a SMS to notify cheap flights (return trips) in next 6 months. Installing Download the Python 3 i

Aytaç Kaşoğlu 2 Feb 10, 2022
SMS Based Headless Browsing

Browse the internet without a network connection - Submission for ConUHacks VI

Zafir Khalid 2 Feb 7, 2022
A simple implementation of an RPC toolkit

Simple RPC With Raw Sockets Repository for the Data network course project: Introduction In this project, you will attempt to code a simple implementa

Milad Samimifar 1 Mar 25, 2022
Modern Denial-of-service ToolKit for python

?? Impulse Modern Denial-of-service ToolKit ?? Main window ?? Methods: Method Target Description SMS PHONE Sends a massive amount of SMS messages and

null 1 Nov 29, 2021
A fire and forget command-line tool to allow for easy transitions of VPN connections between a pool of AWS machines.

VPN Swapper A fire and forget command-line tool to allow for easy transitions of VPN connections between a pool of AWS machines. Dependencies poetry -

Workday 5 Jul 7, 2022
This is a python based command line Network Scanner utility, which input as an argument for the exact IP address or the relative IP Address range you wish to do the Network Scan for and returns all the available IP addresses with their MAC addresses on your current Network.

This is a python based command line Network Scanner utility, which input as an argument for the exact IP address or the relative IP Address range you wish to do the Network Scan for and returns all the available IP addresses with their MAC addresses on your current Network.

Abhinandan Khurana 1 Feb 9, 2022