Session Profiles ＋
Macros ● REC＋
Command History (F12=back F11=fwd)
▶ No commands yet
SYS—
LU—
MODEL—
ROW00
COL00
APP—
NOT CONNECTED
PROTO3270
--:--:--
BH
Settings
Keys
Transfer
⚙ AI
⬡ Assist
🔒 Sec
Color Theme
Display
100%
px, blank = auto
Connection
SSH Terminal
Key Remapping
PF3 EndF3
PF7 Scroll UpPgUp
PF8 Scroll DownPgDn
Enter / TransmitEnter
SysReq / AttnEsc
Insert ModeIns
Clear ScreenCtrl+L
New SessionCtrl+T
Open AI AssistCtrl+K
Toggle SidebarCtrl+B
Next SessionCtrl+.
Prev SessionCtrl+,
Anthropic Claude
200K ctx
AI Provider
API Key
🔒 Memory only — never written to disk.
Model ⟳ loading…
API Key
🔒 Memory only. Up to 128K token context.
Model ⟳ loading…
Google API Key
🔒 Memory only. Up to 1M token context.
Model ⟳ loading…
Ollama Base URL
Model ⟳ loading…
No API key needed — runs locally.
LM Studio Base URL
Model ⟳ loading…
No API key needed — runs locally via LM Studio's OpenAI-compatible server (Developer tab → Start Server).
GitHub Token
🔒 PAT with models:read scope.
Model
Not tested
Generation Options
⬡
3270 AI Assist
AI assistant · screen-aware
⬡
3270 AI Assist
Ask anything about this screen,
TSO · ISPF · JCL · REXX · errors.
• Screen context is active
TSO · ISPF · JCL · REXX · errors.
• Screen context is active
Include screen
WALKTHROUGHS
FIELD ANALYSIS
Field Length Disclosure — MDT + buffer-address deltas reveal how many characters were typed into a nondisplay field, even though the characters themselves are masked.
INTERCEPT
MONITOR
INJECT
Sends the selected AID key directly to the host. Does not type text — use the terminal for that.
RACF PROBE
Auto-probes TSO, z/VM, or CICS logon screens with a credential wordlist. Navigate to a logon screen first. FOR AUTHORIZED USE ONLY.
Wordlist — USERID,PASSWORD per line
Delay (ms)
SESSION HYGIENE
Cross-Session Buffer Bleed — detects a pooled LU's controller buffer surviving into the next session before the fresh Erase/Write. Set an LU Name in the connect form, connect, disconnect, then reconnect with the SAME LU Name within ~90s. FOR AUTHORIZED USE ONLY.
VM MINIDISK SECURITY
VM Minidisk Password Exposure — CP has no masked-input primitive for command arguments, so a LINK minidisk password typed at the CP READ prompt renders in cleartext. Connect to a z/VM CP session and type e.g.
LINK MAINT 191 191 MR mysecretpw. FOR AUTHORIZED USE ONLY.PROTOCOL FUZZER
Sends mutated 3270 AID records and classifies host responses (screen / no-response / disconnect). FOR AUTHORIZED USE ONLY.
Iterates 7 crafted SBA addresses: zero, max-14bit, all-bits-set, high-bit, both-top-bits, 12-bit-encoding, EBCDIC-boundary.
z/TPF CONSOLE
DETECTED
OPER
z/TPF operator console detected. Tools inject ZSHOW/ZTEST commands and parse responses. Connect as TPFOP01, SYSOP01, or ADMIN01 to test privilege boundaries. FOR AUTHORIZED USE ONLY.
IN-TRANSIT MONITOR
Detects and flags unencrypted TN3270 sessions. Plaintext traffic is shown with captured screen data as exposed bytes — proving what an on-path attacker sees. IND$FILE transfers are flagged individually. FOR AUTHORIZED USE ONLY.
RECON TOOLS
Host reconnaissance from TSO READY — RACF policy analysis, user/group enumeration, and dataset discovery. No special privileges required beyond normal TSO access. FOR AUTHORIZED USE ONLY.
RACF SETTINGS ANALYZER
Issues
SETROPTS LIST and parses password policy (interval, history, lockout, length) and security class activation. Flags NOREVOKE, weak rotation, and inactive DB2/CICS/IMS classes.RACF USER/GROUP ENUMERATOR
Issues
SEARCH CLASS(USER) and SEARCH CLASS(GROUP) — collects all RACF user IDs and group names, paging through output automatically.DATASET RECON SCANNER
Issues
LISTCAT LEVEL(prefix) for each prefix — discovers datasets and flags sensitive names (PASSWORD, KEY, CERT, PARMLIB, PAYROLL, etc.).
Level prefixes — one per line
ENCRYPTION AUDIT SCANNER
Audit specific datasets for DFSMS at-rest encryption status via LISTCAT ENT() ALL. Import flagged datasets from the recon scan above, or enter names manually.
SYSTEM ACCESS CHECKS
APF library RACF coverage and SYS1.PARMLIB member read access — both from TSO READY. Unprotected APF libraries allow privilege escalation; readable PARMLIB members expose system configuration. FOR AUTHORIZED USE ONLY.
APF LIBRARY SCANNER
LISTAPF enumerates all APF-authorized libraries. Each is checked for a RACF profile via LISTDSD — a missing or weak profile means any authenticated user can write a backdoor program and gain superuser authority.
PARMLIB ACCESS CHECK
Tests read access to SYS1.PARMLIB members via ALLOC SHR — non-destructive. Readable members expose SMF config, APF list, SVC table, and z/OS UNIX parameters.
CICS TRANSACTION SCANNER
At a CICS clear screen, probe transaction IDs from a wordlist. DFHAC2001 "not authorized" means the transaction EXISTS — the attacker knows it is defined even without access. FOR AUTHORIZED USE ONLY.
IBM i SECURITY (AS/400)
TN5250 targets only. Sign on and stop at an AS/400 menu (with a "Selection or command" line) before running. FOR AUTHORIZED USE ONLY.
SYSTEM VALUE SECURITY ANALYZER
WRKSYSVAL reads the security system values in one screen and flags weak settings — QSECURITY < 40, QMAXSIGN(*NOMAX), QAUDCTL(*NONE), weak QPWD* / QCRTAUT / QALWOBJRST — with a recommended value.
USER PROFILE & SPECIAL-AUTHORITY ENUMERATOR
WRKUSRPRF enumerates user profiles, then DSPUSRPRF reads each one. Profiles with *ALLOBJ/*SECADM, a default password (password = profile name), or LMTCPB(*NO) are privilege-escalation risks.
OBJECT / *PUBLIC AUTHORITY SCANNER
WRKOBJ lists objects, then DSPOBJAUT reads each one's *PUBLIC authority and private grants. *PUBLIC *ALL (CRITICAL) or *CHANGE (HIGH) on sensitive objects (PAYROLL, EMPMAST, CONFIG) means any user can read or alter protected data; a risky private grant (named user with *ALL/*CHANGE) raises a sensitive object to MEDIUM.
NETWORK ATTRIBUTES ANALYZER
DSPNETA reads the network attributes and flags remote-access exposure: JOBACN(*FILE) auto-runs inbound job streams (RCE), DDMACC(*ALL) opens DDM/DRDA, PCSACC / ALWANYNET widen the client/APPC surface.
JOB DESCRIPTION PRIVESC SCANNER
WRKJOBD flags job descriptions that name a fixed USER() and are usable by *PUBLIC — any user can SBMJOB with that JOBD and run code as that user. CRITICAL when the user is the security officer.
AUTHORIZATION LIST SCANNER
WRKAUTL then DSPAUTL per list. An over-permissive *PUBLIC on an authorization list (*ALL/*CHANGE) cascades to every object it secures — the scan lists those objects.
ACTIVE JOB SCANNER
WRKACTJOB flags jobs running under a privileged profile and network host servers (a remote attack surface). Run the User Profile Enumerator first — this scan cross-references the profiles it rated CRITICAL/HIGH.
TN3270E NEGOTIATION ANALYZER
Displays TLS version, cipher suite, and certificate details for every active session. Also surfaces TN3270E negotiation status, terminal model, and LU. Flags plaintext sessions, weak ciphers, self-signed or expired certs, and missing TN3270E negotiation.
Click Refresh to analyze active sessions
SDSF JOB & STC SCANNER
Two tools: (1) SDSF Screen Parser — navigate to an SDSF ST or DA panel, then click Refresh to parse visible jobs and flag system STCs visible from your privilege level. (2) STC Profile Scanner — at TSO READY, checks each STC's RACF STARTED class profile. Missing profiles mean STCs run under the default user. FOR AUTHORIZED USE ONLY.
SDSF JOB PARSER
Navigate to SDSF → ST or DA panel in the terminal, then click Refresh. No commands are sent — the tool reads the visible screen.
Navigate to SDSF first
RISK JOBNAME JOBID OWNER PRTY QUEUE
STC PROFILE SCANNER
Requires TSO READY prompt. Checks RACF STARTED class profile for each STC — missing profile means the STC runs without a dedicated user ID.
Idle
DB2 TOOLS
Three tools for DB2 security reconnaissance: subsystem enumeration, RACF authority scanning, and connection profile analysis. All require a TSO READY prompt. FOR AUTHORIZED USE ONLY.
SUBSYSTEM SCANNER
Tries
DSN SYSTEM(xxx) for each ID — classifies ACCESSIBLE / DENIED / NOT_FOUND, extracts version from connection banner.
Subsystem IDs — one per line
Delay (ms)
RACF-DB2 AUTHORITY SCAN
Issues
SEARCH CLASS(xxx) for four DB2 RACF resource classes — maps which DB2 objects are RACF-protected and lists profile names.
Classes: DSNR (connections) · MDSNPN (plans) · MDSNTB (tables) · MDSNSP (procs)
CONNECTION PERMISSION PROBE
Issues
RLIST DSNR subsys.TYPE ALL for BATCH / DB2CALL / DDF / SPACENAM. Highlights PUBLIC access grants — a common misconfiguration.
Subsystem