In this paper, we explore a dual-sniffer passive localization system that detects the timing difference of signals from both commercial base station (eNb) and user equipment (UE) to the sniffers. We design two localization schemes for UE localization: a time of arrival (ToA) based scheme and a time difference of arrival (TDoA) based scheme. In the ToA-based scheme, we derive two ellipse equations from measured arrival times at two sniffers, enabling direct numerical computation of the estimated position. For the TDoA-based scheme, we relocate one sniffer to a different position to obtain two sets of TDoA measurements, resulting in hyperbola equations. We then apply a least squares (LS) algorithm to analytically estimate the UE's position. Simulation results validate the effectiveness of the proposed TDoA-based scheme, demonstrating improved accuracy in UE positioning.We build a platform based on the considered localization system and conduct real-world experiments. The experimental results confirm the accuracy and practicality of the TDoA-based dual-sniffer localization scheme, demonstrating improved precision in passive localization.