Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2025-5777 — Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy). | Kitploit
Tools/GitHubGitHub/nocerainfosec/cve-2025-5777
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingLearning & Education
GitHubnocerainfosec/cve-2025-5777

cve-2025-5777

Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).

View Repository
3121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CitrixBleed2 - CVE-2025-5777 PoC Scanner

This repository contains an advanced Proof of Concept (PoC) scanner for CVE-2025-5777, dubbed CitrixBleed2, a memory disclosure vulnerability affecting Citrix NetScaler ADC and Gateway.

I did some changes to the original poc, this script is based on research originally published by WatchTowr Labs, with enhancements for deeper information extraction and secure memory leak analysis.

Disclaimer: This tool is provided for educational and authorized testing purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.

About the Vulnerability - CVE-2025-5777

CVE-2025-5777 is a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).

By sending specially crafted HTTP POST requests to the authentication endpoint, an unauthenticated attacker can trigger memory disclosure — leaking sensitive data from heap memory.

This issue is a follow-up to the original "CitrixBleed" (CVE-2023-4966), and was disclosed in July 2025.

Technical Summary:

  • Vulnerable Endpoint: /p/u/doAuthentication.do
  • Attack Vector: Network (unauthenticated)
  • Impact: Disclosure of memory content
  • CVSS Score: 7.5 (High)
  • Disclosure Source: WatchTowr Labs
  • DoublePulsar: DoubblePulsar

    • The original discovery and in-depth analysis were conducted by the WatchTowr Labs research team. This PoC was inspired by their publication and enhanced for extended detection, evidence logging, and memory analysis by me.

    Features

    • Exploits the CVE-2025-5777 (CitrixBleed2) memory disclosure vulnerability

    • Collects leaked memory content via crafted POST /p/u/doAuthentication.do requests

    • Extracts sensitive data like:

      • Session cookies
      • Tokens
      • Basic Auth headers
      • Passwords and JWTs

    • Displays and logs TLS certificate metadata (subject, issuer, validity)

    • Automatically redacts known branding from specific organizations (e.g., removed specific vendor mentions)

    • Saves leaks with a timestamped output file to prevent overwrites

    Usage

    Single Target

    root@kitploit:~
    python3 cve-2025-5777.py -t <target> -r 5 -T 5 -v

    List of Targets

    root@kitploit:~
    python3 cve-2025-5777.py -l targets.txt -r 3 -T 10

    Output File Customization

    root@kitploit:~
    python3 cve-2025-5777.py -t <target> -o custom_output.txt

    If -o is not specified, a timestamped file is created automatically (e.g., citrix_leaks_20250705_154312.txt).

    Detection Technique

    The tool sends malformed authentication requests to:

    root@kitploit:~
    POST /p/u/doAuthentication.do HTTP/1.0

    With a short payload and specific User-Agent to trigger the memory leak.

    It parses the raw response for high entropy data, certificate metadata, and sensitive content (via regex).

    Legal Notice

    • This tool must only be used in authorized penetration testing or controlled environments.
    • All users are solely responsible for ensuring legal and ethical use.

    Credits

    • Original discovery and writeup: WatchTowr Labs
    • Enhanced PoC author: Guilherme Nocera (@guilhermenocera1)
    • Based on open-source research and crafted for Brazilian and global security professionals.

    Related

    • CVE Details - CVE-2025-5777
    • Citrix security advisories
    • WatchTowr Labs Article

    License

    This repository is released under the MIT License.

    Stay secure. Test responsibly.

    Download Tool