if u wanna just make a local attack, like the enumeration of SSID, creating a fake station ( MITM ), and reconnecting the target phone through your station - it's much simple than the global SS7 (its about 1000 euro)
The global SS7 - a prerogative of special services. Either create your own mobile operator or search in African countries))). The price begins 15,000 euros