Today I’m proudly releasing the first version of apnbf, a small python script
designed for enumerating valid APNs (Access Point Name) on a GTP-C speaking
device. It tries to establish a new PDP session with the endpoint via sending a
createPDPContextRequest. This request needs to include a valid APN, so one can
easily distinguish from a valid APN (which will be answered with a
createPDPContextResponse) and an invalid APN (which will be answered with an
error indication message). In addition the tool also parses the error indication
and displays the reason (which should be “Missing or unknown APN” in case of an
invalid APN).
So, after having a completely new release yesterday, we will stay with already
known but updated software today. You might have heard of gtp_scan before, which
is a small python script for scanning mainly 3G and 4G devices and detecting GTP
(GPRS Tunneling Protocol) enabled ports. As GTP is transported via UDP and we
all know, UDP scanning is a pain, the tool uses the GTP build-in echo mechanism
to detect GTP speaking ports. Since the last version I’ve implemented some new
features:
gtp_scan is a small python script that scans for GTP (GPRS tunneling protocol)
speaking hosts. To discover those hosts it uses the GTP build in PING mechanism,
it sends a GTP packet of the type ECHO_REQUEST and listens for an incoming GTP
ECHO_REPLY. Its capable of generating ECHO_REQUESTS for GTP version 1 and GTP
version 2. Also the script can scan for both, GTP-C and GTP-U (the control
channel and the user data channel), only the port differs here.