CVE-2019-19781

CVE-2019-19781 CVE-2019-19781 Attack Triage Script The script can be run on your affected Citrix ADC devices to assist in determining if a compromise has occured. It will quicky capture any associated commands or files that were used as part of the attack unless cleanup has occured: $...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...

CVE-2025-5777

CVE-2025-5777 - Citrix NetScaler Memory Leak Exploit 📌 Overview This tool demonstrates CVE-2025-5777 , a critical memory disclosure vulnerability in Citrix NetScaler ADC/Gateway devices. The exploit leaks sensitive memory contents via malformed authentication requests. Key Features: ✔ Memory leak...

CVE-2025-5777

CVE-2025-5777 placeholder for CitrixBleed 2.0 CVE-2025-5777...

citrix-netscaler-memory-leak

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install citrix-netscaler-memory-leak Run bellow command to check citrix-netscaler-memory-leak -h Configurations 2. We integrated with t...

CVE-2023-3519

CVE-2023-3519 NetScaler Citrix ADC CVE-2023-3519 Scanner A simple scanner to find netscalers and look at the las modified date on the HTTP header response this project is a scanner made by me in C using the source-code of mrr3b00t in powershell...

CVE-2019-19781

This article is about CVE-2019-19781, a Remote Code Execution RCE vulnerability due to Directory Traversal in Citrix ADC and Gateway. This remote code execution vulnerability occurs because the validation of the smb.conf file under the /vpn path's ../vpns is not properly performed. Steals system...

CVE-2025-7775

CVE-2025-7775 Version detection PowerShell There's also a cool file hash based method: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py You can also potentially use the client binaries to enumerate the version not sure if you need auth... not looked at...

CVE-2023-3519-BackdoorCheck

cve-2023-3519-citrix-scanner This script is a basic Citrix Scanner for CVE-2023-3519. We try to identify vulnerable Citrix Gateways/ADCs by looking at the HTTP headers. How it works During our analysis of this vulnerability, we and our friends at CERT-Verbund noticed, that our patched systems had...

CVE-2023-24488-SIEM-Sigma-Rule

Sigma Rule: Detection of Pre-Auth XSS CVE-2023-24488 Detect Citrix Gateway Pre-Auth XSS CVE-2023-24488 vulnerability exploitation attempts. This Sigma rule looks for XSS attack patterns in the postlogoutredirecturi query parameter. Rule Description The provided Sigma rule is designed to identify...

CVE-2018-14083

CVE-2018-14083...

cve-2024-8069-exp-Citrix-Virtual-Apps-XEN

CVE-2024-8068 and CVE-2024-8069 Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code Execution Vulnerability Check out our blog post for detailed technical information. https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 Exploit Demonstration python...

webcvescanner

shitsniffer Gather a list of Citrix appliances in a country / state pair, and check if they're vulnerable to CVE-2019-19781. Results are output as JSON which can be wrangled quite nicely into a meaningful PowerBI report. It does this by querying Shodan for all results in a particular country...

watchTowr-vs-Citrix-Netscaler-CVE-2026-88772

watchTowr-vs-Citrix-Netscaler-CVE-2026-88772 Detection Artifact Generator for Citrix NetScaler CVE-2026-88772 See our blog post for technical details. Detection in Action / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / /...

CVE-2025-6543

CVE-2025-6543 Citrix Bleed 2 PoC...

CVE-2019-19781

CVE-2019-19781 Just a python3 CVE-2019-19781 exploit for Citrix behind a cache. This version accepts '', '|', '2&1'... etc USAGE python3 CVE-2019-19781.py citrix.example.org 'cat /etc/passwd' Todo Repeat if Age header in response. Continuous mode -c. Check mode Get /vpn/../vpns/cfg/smb.conf...

citrix_bleed_2

Citrix Bleed 2 PoC Scanner CVE-2025-5777 This script is a Proof-of-Concept PoC scanner for the hypothetical vulnerability "Citrix Bleed 2" CVE-2025-5777. It is designed to detect potential memory leaks from Citrix ADC devices by sending oversized requests and analyzing the responses for sensitive...

CVE-2023-3519

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and shellcode for Citrix VPX 13.1-48.47. For the full writeup, click here. Usage NASM is required to build the shellcode. $ sudo apt install nasm The included shellcode will download and run a shell script from a remote https server. The...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

CVE-2023-24489-poc

CVE-2023-24489-poc POC for CVE-2023-24489 with bash. It needs a list of target.txt full of the targets you want to test in this format: https://example1.com https://example2.com https://example3.com The file must be within the same dir where the bash script is executed. Please use with caution !...