Open Cell Range

A virtual range for cellular attacks — and for catching them. Nothing here transmits.

About this simulation — read before you start

This is a pure simulation. The radio world is a data structure in memory. Nothing is transmitted, received, or measured — there is no SDR, no baseband, no SIM, no antenna, and no code path that could drive any of those.

It is built on published, standardised knowledge: the GSM one-way-authentication problem, the LTEInspector / aLTEr family of pre-authentication weaknesses, and the 5G-AKA linkability results — all documented in open standards and peer-reviewed research. Subscriber keys are the published 3GPP test vectors; no real subscriber keys exist anywhere in this project.

It is defence-first: every attack drill has a matching defender drill, and the same passive-monitor logic that raises a finding here is what a real detector (like Rayhunter) would conclude from the same air.

Read the full ethics note

Workshop / facilitator tools — scoreboard, worksheet, instructor notes

Everything below lives only in this browser's local storage — no accounts, no backend, nothing collected about anyone who runs this. A workshop table runs it competitively just by having each person show their own screen.

Scoreboard

    Instructor notes

    Facilitator-only cues per drill — what to point out, what a group often misses. Shown inline under the loaded drill's flags when enabled.

    Worksheet

    A print-friendly handout listing every drill and its teaching point, with room to write in flag status by hand — for a room that wants a paper trail alongside (or instead of) the screen.

    Guided course

    All nine drills, in teaching order, with a line of framing before each one. This is not a separate simulation — “Open this lesson” loads the exact same drill the catalogue below does, so stepping away from the course at any point just leaves you with a drill loaded in the ordinary sandbox.

    Lesson 1 of 9 0/9 lessons complete

    Choose a drill

    Each generation tries to fix the last one's headline flaw. Every one still leaks somewhere except where the fix is doing its job — that contrast is the point. Drills run the real (simulated) attack against a real (simulated) air; a flag is only earned when the world actually reaches that state.