CICS Application Penetration Testing

In early 2023 a new mainframe attack tool was discussed: hack3270. The creators of this tool spoke about it but did not release it. Then in mid 2023 it was released as an open-source tool. This tool was designed (with support from the speaker) to ease and accelerate the testing of CICS applications, specifically targeting TN 3270 weaknesses and common CICS application pitfalls.

Attendees will learn some of the common security weaknesses we find in CICS applications, how we can target those weaknesses and how to automate some of their testing. Specifically, this talk will walk through various transactions in the Damn Vulnerable CICS Application (freely available as an open-source CICS application) using the hack3270 tool, demonstrating the types of attacks used during penetration testing. The presentation will also go over some of the code that leads to these weaknesses and how they can be prevented.