CVE-2019-19781

CVE-2019-19781 Automated script for Citrix ADC scanner CVE-2019-19781 using hosts retrieved from Shodan API. You must have a Shodan account to use this script. Click here if you don't have Shodan account. Installation 1. Install dependencies. CentOS & Fedora yum install git python3 -y Ubuntu &...

CVE-NetScalerFileSystemCheck

CVE-NetScalerFileSystemCheck This script checks the Citrix Netscaler if it has been compromised by CVE-2019-19781 attacks and collects all file system information. The following files and logs will be checked Latest version 1.13: Template folders for XML files Apache Access logfiles Apache Error...

citrix-netscaler-triage

Citrix NetScaler Triage This repository contains triage scripts for Citrix NetScaler devices: iocitrix.py -- a Dissect script to Triage a Citrix NetScaler image/target. scan-citrix-netscaler-version.py -- Scan and fingerprint the version of a NetScaler device over HTTPs...

netscaler-ctx697096-checker

NetScaler checker for CTX697096, CTX697174 and CTX697191 Read-only precondition and exposure checker for the Citrix NetScaler ADC / NetScaler Gateway security bulletin CTX697096 , covering CVE-2026-88771 through CVE-2026-88778 , and for CTX697174 , covering CVE-2026-88779 the SAML crash attack, a...

CVE-2020-0601

CVE-2020-0601 Remote Code Execution Exploit CVE-2020-0601- Citrix Application Delivery Controller & Gateway...

SocksOverRDP

Socks Over RDP / Socks Over Citrix This tool adds the capability of a SOCKS proxy to Terminal Services or Remote Desktop Services and Citrix XenApp/XenDesktop. It uses Dynamic Virtual Channel that enables us to communicate over an open RDP/Citrix connection without the need to open a new socket,...

CVE-2026-19490

CVE-2026-19490 — NetScaler ADC/Gateway SAML authentication bypass Unauthenticated session forgery on Citrix NetScaler ADC / NetScaler Gateway via the SAML HTTP-Redirect binding handler at GET /cgi/samlauth. CVSS 4.0 9.3, CWE-288. Bulletin CTX696939 2026-08-19, no workarounds. Credit for the...

citrixInspector

citrixInspector citrixInspector.py formerly cve20233519inspector.py is a Python-based, passive vulnerability scanner for Citrix ADC / Citrix Gateway / NetScaler ADC / NetScaler Gateway appliances. It fingerprints the exact firmware build of a target without authentication, and reports every known...

CVE-2019-19781-Forensic

CVE-2019-19781-Forensic Note : My advice is now to use the official tool published by fireeye & citrix : https://github.com/fireeye/ioc-scanner-CVE-2019-19781 This little script was created to help security analyst to discover traces of successful CVE-2019-19781 exploits on their systems. Feel fr...

CVE-2023-4966

CVE-2023-4966 CitrixBleed Programm to exploit Citrix Applications with a range of ip adresses here is how you compile it for windows, macOS, or Linux GOOS=windows GOARCH=amd64 go build -o citrix citrix.go GOOS=darwin GOARCH=amd64 go build -o citrix.exe citrix.go GOOS=linux GOARCH=amd64 go build -...

CVE-2019-19781_IOCs

CVE-2019-19781IOCs IOCs for CVE-2019-19781 citrixhoneypotnslookup.txt contains whois results for the IP addresses listed in ips.txt. these were the addresses that showed up most frequently in the logs of the honeypot discussed here:...

watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 Detection Artifact Generator for Citrix NetScaler CVE-2026-88771 See our blog post for technical details. Detection in Action ./watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py --target https://netscaler.local/ --command 'id/var/tmp/watchTowr' / | | |\ ...

ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...

CVE-2026-3055-Scanner---Herramienta-de-Detecci-n

🔍 CVE-2026-3055 Scanner - NetScaler Memory Overread Detection Tool ⚠️ WARNING This tool is for educational purposes and authorized testing only. Do not use on systems without explicit permission from the owner. 📋 Description Detection tool for CVE-2026-3055 that identifies Citrix NetScaler ADC and...

cve-2023-3519-citrix-scanner

cve-2023-3519-citrix-scanner This script is a basic Citrix Scanner for CVE-2023-3519. We try to identify vulnerable Citrix Gateways/ADCs by looking at the HTTP headers. How it works During our analysis of this vulnerability, we and our friends at CERT-Verbund noticed, that our patched systems had...

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP check Python helper to probe Citrix NetScaler / NetScaler Gateway appliances for CVE-2026-3055 memory overread when acting as a SAML Identity Provider. Detection logic matches the public write-up from watchTowr Labs. Prerequisites Python 3.10+ Only applies to...

CVE-2020-8209

Usage and Disclaimer This script is a batch detection script for the Citrix XenMobile directory traversal vulnerability CVE-2020-8209. Usage: Python CVE-2020-8209-Multiple.py url.txt The vulnerable addresses are output in vul.txt Affected Versions: Citrix XenMobile Server 10.12 before RP2 Citrix...

Citrix-ADC-RCE-CVE-2020-8193

Citrix ADC RCE 0x01 CreateSession request POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: 192.168.3.18:9080 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/76.0.3809.132 Safari/537.36...

CVE-2019-19781

CVE-2019-19781 Citrix ADC Remote Code Execution python usage: python CVE-2019-19781.py http://192.168.3.244 0x01 download NSVPX-ESX-13.0-47.22nc64.zip https://www.citrix.com/downloads/citrix-gateway/ configure static networ 0x02 nmap scan Scanning 192.168.3.244 65535 ports Discovered open port...

Citrix-cve-2025-6543

Citrix CVE-2025-6543 Script to check if Citrix is vulnerable to CVE-2025-6543 citrix-cve-2025-6543-check.py is a Python 3 command-line script that identifies NetScaler ADC / Gateway instances vulnerable to the CVE-2025-6543 memory overflow published by Citrix in June 2025. Designed for pentesters...