Enumerating z/OS TSO user IDs
In IBM mainframes (z/OS), the TSO login panel reveals information about authorized users through error messages. Attackers can leverage this information to enumerate valid user IDs of the system.
This recipe demonstrates how to enumerate z/OS TSO User IDs with Nmap.
How to do it...
To enumerate z/OS TSO user IDs with Nmap, enter the following command:
$ nmap -sV --script tso-enum <target>
Any valid users will be listed in the script output:
PORT STATE SERVICE VERSION 23/tcp open tn3270 IBM Telnet TN3270 | tso-enum: | TSO User ID: | TSO User:PETE - Valid User ID | TSO User:YOLI - Valid User ID | TSO User:PABLO - Valid User ID |_ Statistics: Performed 6 guesses in 3 seconds, average tps: 2
The script emulates a TN3270 screen. Next, we will learn...
