Re: [PEN-TEST] Pen-Testing AS/400

[David Knaack <dknaack () RDTECH COM>]

> From: "Mike Ahern" <mc_ahern () YAHOO COM>
> > I have found that often AS/400's do not have many
> > security features enabled

OS/400 V4R4 has a little bit of an info leak in the
login screen.  As you enter usernames and passwords,
it will tell  you if the account exists or (I think)
if it is disabled.

Error messages like:

CPF1120 - User %s does not exist.

CPF1107 - Password not correct for user profile.

CPF1118 No password associated with usr %s.
(curiously, there is no '-' in that one.)

I presume that the 'no password' message means that
the account has been disabled in some fasion.

As usual, helps the cracker to spend time on
existing, enabled accounts.

DK