Mission for Mainframe | Part 1: Relevant Today

NetSPI's Black Hat and DEF CON research shows z/OS Unix is an overlooked mainframe attack surface, with paths from authenticated user to APF-authorized code execution and UID 0.

Over 90% of mainframes run CICS for transaction management. This article walks through seven practical testing approaches for uncovering common vulnerabilities in mainframe CICS and IMS applications.

When pentesters can't run TSO commands like PARMLIB, in-memory control blocks still reveal authorized command tables. A REXX script walks the CVT pointer chain to dump z/OS TSO configuration data.

Abusing the RACF LISTUSER command on z/OS lets adversaries enumerate all user profiles and identify administrative accounts, enabling targeted password sprays and attacks on mainframes.

Based on dozens of mainframe assessments, NetSPI's 2025 State of the Platform report covers MFA adoption, DES-to-AES cryptographic modernization, and persistent security gaps in enterprise mainframes.

NetSPI's mainframe pentesting team won first place at SHARE's inaugural Capture the Flag event sponsored by Broadcom, solving z/OS challenges while presenting on blackbox pentesting and OMVS attacks.