For years I have told mainframe security newcomers the same thing: If you want to learn how to attack and defend a system, you need to use that system. Unfortunately, z/OS is not something you spin up on a laptop over lunch or throw into your home lab. Mainframe access is one barrier that has kept a generation of curious, talented people away from the platform that runs the world’s economy.
So, I built a simulation of one, named it GIBSON, and now give it away for free.
Why GIBSON exists
GIBSON (named after the ultimate machine in the film ‘Hackers’) began life out of necessity. I am writing a book, Hacking Mainframes for No Starch Press, now in the technical editing phase (thanks to Mark Wilson for casting his expert eye over it). A hands-on security book is only ever as good as the lab the reader can run alongside it. That is no problem if you are writing about Windows or Linux. Your reader grabs a free ISO, spins up a virtual machine in ten minutes, and follows along chapter by chapter.
The mainframe offers no such luxury, as you can’t just download z/OS and boot it on a spare laptop. Real access means licensing, which means a process and a cost that make perfect sense for a corporation but is well beyond what any individual would realistically take on, especially if it was something that person was just curious about.
Even someone determined to learn the platform and its specific security tooling on their own runs straight into that wall. And book readers are, almost by definition, individuals: just one curious person with a laptop, an interest, and motivation.
The reader I most wanted to reach, the one who is casually interested, or brand new to z/OS, and simply wants to follow the book and try things for themselves, had nowhere to go – no way in at all. There was no safe place to make mistakes. There was no environment where you could scan, upload a JOB, crack a hash, or fumble a REXX exec without either breaking something expensive or being told the mainframe was out of scope.
I started writing a simulator in Python just to see where it went. Thirty years ago, I started my mainframe journey. Two years ago, all GIBSON did was read file names and provide the output from the text in them. Over time, however, AI improved, my understanding of what was required grew, and (luckily for me) an amazing community of experts filled the gaps. The community has been a mentor to me.
What GIBSON grew into
What surprised me most was how far it outgrew its original job. I set out to build a handful of labs for a book. I ended up with something that behaves like a small z/OS estate, with a security manager that makes real decisions, subsystems that talk to each other, and logs that actually reflect what you did. Somewhere along the way it stopped being a teaching aid and started being a place to experiment, and that changed how I think about training people on this platform entirely.
GIBSON is now 85,000 lines of code. It is built from the ground up, with no emulated hardware and no borrowed operating system, just a simulator designed to respond the way a real system responds. It models the screens, the protocols, the security manager, and the logs closely enough that the labs feel real.It does so safely, with fake data, so that learning never comes at somebody else’s expense.
Inside it you can do the things the book teaches.
- Respond to a network scan, log on over TN3270, work with datasets, submit JCL, and write REXX.
- Pull a RACF database, download it, and crack the legacy hashes with John the Ripper exactly as you would in a real security assessment.
- Poke at CICS and Db2, walk an SMF trail to see what the defenders would have caught, and follow a privilege escalation path from a nobody account to SPECIAL.
You can keep the changes or reset and start again in five minutes.
“You can carry a teaching mainframe in your bag. You can run GIBSON on an Android, a Raspberry Pi, an old laptop, or a server.”
And, because it’s Python and has a small footprint, I have run GIBSON on an Android phone, on a Raspberry Pi (Kyle Pressley even has it sitting next to his 3D-printed z17), and on everything from an old laptop to a server, so the mainframe finally becomes portable. You can carry a teaching mainframe in your bag, which is not a sentence I ever expected to write.
Don't miss these other great articles
Where AI comes in
There is one more thing worth mentioning, and it points forward rather than back. The community has produced a huge amount of offensive and defensive tooling over the years, far more than any one person could ever study by hand, and this is where I think AI does real work.
“Thanks to AI, a learner in front of GIBSON is being taught the real thing rather than a convenient approximation.”
Rather than using AI to replace the experts, I used it to learn from the experts. AI read across the community’s tools, scripts, and research. It can understand how a real system ought to respond to a given probe, and help GIBSON reproduce that behaviour, comparing the simulator’s answers against the tools that inspired them and flagging where the realism slips. It can help translate scarce, hard-won mainframe knowledge into an educational environment that behaves correctly, so that a learner in front of GIBSON is being taught the real thing rather than a convenient approximation.
Used that way, AI does the work of 10 people. There is a neat symmetry to it, too: the tools the community built to break into mainframes become the reference for teaching people how mainframes really behave – and AI is the thing that lets one person keep up with all of it. AI can help make sure all the accumulated knowledge reaches the people coming next, and that GIBSON keeps getting closer to the real thing with every release.
The mainframe has carried critical workloads for decades, and for far too long it has been treated as unreachable, mysterious, and off-limits to newcomers. I do wish IBM had given away cut-down student single-user versions, like Novell used to back in the 1990s when I was a young consultant trying to research and mentor. GIBSON is an attempt to change that.
A community acknowledgment
The realism that exists in GIBSON came from the mainframe community. GIBSON exists because a community of seriously clever people shared their research, their tools, and their time… and, on more than one occasion, their patience. GIBSON is better, more accurate, and more useful precisely because a community that had every reason to guard its knowledge chose to share it instead. That, more than any feature, is what makes the mainframe world special.
Philip Young and Chad Rikansrud started the foundational research years ago. They created (and continue to create) the scripts and offensive tooling I studied to make GIBSON’s responses. Tools such as ENUM, TShocker, Nmap, passtickets and iNJEctor were invaluable, as was their support along the way. For elements outside my own scope of knowledge, like Vibe coding, I used AI to analyse exactly what the tools were doing and assist with everything from correct network responses to an ACEE.
“A community that had every reason to guard its knowledge chose to share it instead.”
Henri Kuiper, with his MFAudit and RACF-Generator, and Jonathan Prince, with his RACFHound, made it possible for me to create realistic RACF binaries that can be downloaded and cracked with John the Ripper and other tools, exactly as they would be in a real assessment. Jonathan’s collaboration on the Mainframe TTP project has been just as valuable.
The list goes on, and every name earned its place:
- Stephen Johnston, who is currently testing the REXX scripting capabilities.
- Britley Hoff, who helped me get the protocol connections and screens right and gave me some wonderful ideas with her Web3270 client.
- Dave Bulloch, who casually said “I can build you an LPAR.” I genuinely thought it was Christmas.
- Nancy Grimes, whose input on SMF records taught me something I knew almost nothing about.
- Ann Hood, for the encouragement, and for telling me the effort was worth it when I needed to hear it, and her assessment of the ENDEVOR realism.
- Alisdair Gurney, who helped with the technical manual wording and for testing the systems.
- Mark Wilson, who is the technical editor for my book, has pointed out several tiny details many would miss.
GIBSON only exists because of the people who chose to share instead of hoard. To every one of them, thank you. Now, feel free to get hands-on. I can’t wait to see what the future brings!
Gibson can be downloaded from https://github.com/kmilne40/GIBSON.
0 Comments