Part 1 — Orientation

Three chapters, because a reader who understands the shape of the toolkit can read every later page without being told twice, and a reader who does not will misread the interfaces as arbitrary. §1.1 says what the toolkit is. §1.2 states the rules it holds itself to, which are the reason its interfaces look the way they do. §1.3 describes the surfaces those rules are exposed through. §1.4 is the vocabulary, and it is the chapter to return to.

1.1 What this toolkit is

IMSISting is a cellular research toolkit for the GSM, UMTS, LTE and 5G NR air interfaces and the networks behind them. It is organised as sixty-one modules, each of which is:

one shell script under modules/, named by a two-digit number and a noun (07_gsm_attack.sh, 19_cipher_audit.sh, 59_remote_node.sh);
one row in a catalogue that assigns it a category, a name and an icon;
a set of verbs — one --verb per operation, 1,444 of them in total;
a store: a directory under loot/ that the module appends rows to;
a selftest: --selftest, which runs assertions and prints RESULT PASS or RESULT FAIL and exits non-zero on the second.

The sixty-one modules fall into eleven categories, and the categories are how the catalogue, the TUI menu and the GUI dashboard are all ordered:

Category	Modules	What it is for
SYSTEM	5	Dependencies, the radio inventory, the field kit, the killchain, remote nodes
RECON	3	Cell survey, GSMTAP capture, tower mapping
RADIO	14	The air interfaces themselves, from GSM to NR, and the attacks that live on them
ACCESS	7	Getting onto a network: attach, slicing, femtocells, USSD, VoWiFi, RAN sharing
CORE NETWORK	8	EPC, 5G core, SS7, DNS, IMS, NAS, SBA, O-RAN
SIM / IDENTITY	7	The card and the identity: SUCI, OTA, AKA, eSIM, SIM swap, STK
TRACKING	4	Where a handset is: paging, timing advance, CSI fingerprinting, LPP
BASEBAND / DEVICE	4	Below the modem's API: fuzzing, exploits, injection, the baseband file system
ANALYSIS	4	Captures, ciphers, traffic, MAC and RLC
EXPLOIT KITS	3	Catalogues of published vulnerabilities for GSM/UMTS, LTE and NR
INTERCEPT / CARRIER	2	Lawful interception and the carrier API surface

Three things about that split are worth stating plainly, because they are choices and not accidents.

The toolkit is not a chain. No module calls another to complete an attack. A module reads what it needs from loot/ and from the air; a killchain module exists to record the sequence a human performed, not to perform it. This is why one module can be verified without the other sixty - and why a broken module never silently invalidates a neighbouring verdict.

The store is the interface between modules. When an evil twin wants a reconnaissance row to build a cell from, it reads the row out of loot/cell_recon/cells.tsv. When a capture analysis wants to know which cipher a network negotiated, it reads loot/cipher_audit/sessions.tsv. Nothing passes through memory between modules, so every conclusion is reproducible from files on disk, and a store you can read is a store you can audit.

Nothing is a black box with a progress bar. Every long operation either declares what it is waiting for or hands off. A verb that cannot complete says which binary, which transport or which capture it was missing, in a line that begins WHY. That is the single most important property of the toolkit for a researcher: the difference between "there is nothing here" and "I could not look" is the difference between a finding and a guess, and the toolkit never collapses the two. §1.2 turns that into rules.