Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mainframe State of the Platform: 2025 Security Assessment

netspi.com | blog | #penetration-testing | #encryption | #mfa | #security-assessment | #mainframe | #z-os

Summary

Based on dozens of mainframe assessments, NetSPI's 2025 State of the Platform report covers MFA adoption, DES-to-AES cryptographic modernization, and persistent security gaps in enterprise mainframes.
Published
Collected

original ↗

Related coverage

blog · netspi.com
NetSPI Wins First Place at SHARE Mainframe Capture the Flag Event
NetSPI's mainframe pentesting team won first place at SHARE's inaugural Capture the Flag event sponsored by Broadcom, solving z/OS challenges while presenting on blackbox pentesting and OMVS attacks.
blog · hackenproof.com
What Is Penetration Testing? How It Works, What You Get, and When to Test
A pentest is a time-boxed, authorized attack where ethical hackers chain flaws to prove exploitable risk, not just run scans. It outlines deliverables, audit drivers, and when to test.
blog · netspi.com
Legacy Meets Modern: Breaking AD Through NIS & MFA Infrastructure
An engagement walkthrough: root access via Apache NiFi, recovered NIS hashes and Duo Auth Proxy secrets, decrypted MFA traffic, then a DA MSSQL relay via xp_cmdshell to domain admin and DCSync.
blog · netspi.com
Unix Underworld: Tales from the Dark Side of z/OS
NetSPI's Black Hat and DEF CON research shows z/OS Unix is an overlooked mainframe attack surface, with paths from authenticated user to APF-authorized code execution and UID 0.
blog · netspi.com
Internal vs. External Penetration Testing: What You Need to Know
External penetration testing examines internet-facing services, while internal testing simulates insider threats or post-breach attackers. This article compares the two approaches and their use cases.
blog · netspi.com
Hacking CICS: 7 Ways to Defeat Mainframe Applications
Over 90% of mainframes run CICS for transaction management. This article walks through seven practical testing approaches for uncovering common vulnerabilities in mainframe CICS and IMS applications.
back