MF Sniffer is a python script for capturing unencrypted TSO login credentials. It requires Scapy. Given an interface, IP and port this script will try to sniff mainframe user IDs and passwords sent over cleartext using TN3270 (tested against x3270, TN3270Plux and TN3270X). This script does not work if the mainframe is using SSL encryption.
You can download it from the following link: https://packetstormsecurity.com/files/download/120802/MFSniff.zip
Source: https://packetstormsecurity.com/files/120802/MF-Sniffer-TN3270-Password-Grabber.html