What problem does it solve? Generic web scanners misclassify exposed mobile-carrier core network elements as ordinary web servers, causing security researchers to miss critical cellular-auth exposures or, worse, to probe them unsafely and touch subscriber data. ## Core Features & Use Cases - Element Recognition: Detect telecom core infrastructure from hostname tokens (bsf, ims, rcs, hss, diameter, epc) and response signals like 3GPP SOAP namespaces, SIP banners, and GSMA-issued certificates. - Trust Boundary Mapping: Match each element (BSF, HSS/AAA, P-CSCF, XCAP/XDM, SCEF/NEF) to the interface and authentication it should enforce, so misconfigurations become obvious. - Safe Exposure Proof: Demonstrate unauthenticated access using fake identifiers, mTLS checks via openssl, and sibling-node contrast without ever touching real subscriber data. - Use Case: During a carrier bug bounty, recon surfaces nds.bsf.example.com returning a SOAP fault with a urn:3gpp:gba namespace. Use this Skill to confirm it is an unauthenticated GBA BSF, prove it processes operations, and write it up as a cellular-auth critical finding. ## Quick Start Ask the agent to triage a suspicious host like nds.bsf.example.com found during recon and determine whether it is an exposed telecom core element, using only safe non-subscriber probes.
