netscaler-quickcheck
Check. Evaluate. Decide.
Security triage for Citrix NetScaler ADC and Gateway, directly on the appliance.
A scan checks the build against Citrix bulletins, looks for signs of an attack and indicators of compromise, and concludes with a clear verdict. Open source under the Apache 2.0 license, developed by ceterion.
Validated on NetScaler 14.1
Findings in German
13.1 and FIPS: Beta
Apache License 2.0
Why not just use grep?
Pattern. Context. Decision.
A single log entry rarely proves anything. Quickcheck analyzes the context of entries, addresses, and time periods and determines which ones are relevant.
Finding the Sleeper
The spammer who tries four accounts on Monday, takes a break, and returns on Friday stays below every lockout threshold. The cumulative address list detects the return.
Find the spray
Dozens of machines, a thousand account names, one attempt each: grouped by /24, with cycles and accounts, and with the crucial question of whether any of them got through.
Find the account under attack
A brute-force attack on a name is a different type of attack with a different response. It receives its own findings and its own “call this person” instruction.
Find the goal
A successful login after a series of failed attempts is red, showing the account, address, and the three commands that should run first.
Find the exploration site in front of Shell
Check each theme folder for known webshell names, using the actual source from the access log, and display a red line if a webshell path has ever returned a 200 response.
Find the Gap
Missing logs, missing rules, unreadable files: The verdict is then INVESTIGATE and lists what could not be verified. Never OK due to lack of evidence.
Finding the Silent Change
An attacker who modifies the current configuration without saving it leaves no file for the next backup. The Quickcheck compares the current, saved, and previous configurations (ns.conf, ns.conf.0). Unsaved changes are a finding, as is any security-related deviation: new system users, policies, listeners, and management access.
One Run, One Verdict
Read. Assess. Act.
At the end of each race, there is a ACTION-line, a machine-readable RESULT-row and, under each finding, what to do. In plain language and in German, so that administrators, IT management, and auditors can all review the same report.
OK
Exit 0
. Build fixed; no known indicator; no traces in the window.
INVESTIGATE
Exit 1
: Classify findings or fill in gaps in testing.
UPDATE
Exit 2
-Build is vulnerable; schedule an update.
FORENSICS_FIRST
Exit 2
: Signs of compromise. Do not reboot, do not upgrade—back up first.
== 5 Quick Compromise Check == [RED] Known payload path exists: /netscaler/ns_gui/vpn/c88771.json - Source: sygnia 2026-10-01 [RED] Crontab entry for user "nobody" exists (1 line) - known persistence [RED] Listeners from interpreter/shell processes on reachable addresses: | perl nobody *:4444 [YELLOW] Local system users besides nsroot: sec_monitor - confirm each one [RED] System user sec_monitor = known backdoor (LevelBlue) [RED] 2 saved configuration changes to User, Auth, EPA, or Management ... - verify each one: | [new] add ns ip 192.0.2.10 255.255.255.0 -type SNIP -mgmtAccess ENABLED | [new] add system user sec_monitor ... == 6 Verdict == ACTION: FORENSICS_FIRST Signs of compromise found. Do not reboot or upgrade until a backup has been made: 1. Isolate the appliance (failover to a patched node or firewall), check HA file sync, and check the peer as well. 2. Back up: `show techsupport`, `/var/log`, `/var/core`, the specified files, and RAM if possible (CTX694799). 3. Involve Citrix Support; request an official IoC scan. Afterward, perform a rebuild, rotate all secrets (including KEK), and revoke certificates. RESULT host=gw-01 build=14.1-73.41 mode=offline ... compromise=1 red=13 yellow=6 coverage=full action=FORENSICS_FIRST ...
Abbreviated excerpt from an offline run against the test fixture compromised from the repository (synthetic test data, not customer data).
What It Tests
Six sections. One result.
From the build number to the active connection: every check with a documented, adjustable threshold.
1 Build
Compare each CVE line in the rule file against fix builds for each train and conditions such as SAML. End-of-life trains, unsaved configuration.
2. Exposure and Mitigation
SAML, DTLS, management access to SNIPs, responder policies: whether they are bound to the correct vServers and whether their hit counters are changing.
3 and 4 signs of attack
Injection tests involving download hosts and sources, nsaaad crashes, dropper requests, webshell probing, external access attempts, and attacks on gateway accounts.
5 Quick Compromise Check
Payload paths, modified web files, cron jobs, listeners, system users, suspicious processes, active connections to attacker IP addresses, config diffs.
Operator Context
Blocklist, whitelist, and custom indicators in a custom file that survives every update. It can only make the rating stricter, never more lenient.
6 Verdict and Expenses
Reports, JSON, and address lists by run and cumulatively by category for the firewall and SOC, as well as anonymized versions for sharing.
Built for emergencies
Don't touch anything. Document everything.
The tool runs during an incident without becoming part of it.
- Read-only. No network connection, no changes to configuration or system files, no agent, no Python. Writing is limited to the program's own directories.
- Least Privilege. The optional CLI layer uses a service user that a command policy applies to
showandstatLimited. No password in the script or report. Without a service user, Quickcheck checks the saved configuration and states in the report that it was unable to view the current one. - Offline-capable. Runs in the appliance's FreeBSD shell or against a snapshot set, even for an appliance that has already been reinstalled.
- Clear Findings. Each finding explains what was discovered, why it matters, and what to do next. The text is intentionally in German: This tool was developed with and for operators in the DACH region, and a finding that first needs to be translated wastes time in a situation where every second counts.
- Source for each indicator. Each value in the rule file specifies its original publisher, along with the reference and date. Values without a primary source remain inactive. See CREDITS.md and the source log for details.
- Tested before every release. Test logs for each CVE, fixtures with expected verdicts, and platform lints for the NetScaler shell.
- Method in the repository. The two prompts used to generate rules from a new bulletin are publicly available. Every patch undergoes the same lint, origin, and duplicate checks.
Quick Start:
Two files. One command.
For an appliance, only
ns_quickcheck.sh and ns_quickcheck.rules required from the current release.# On the appliance, as root. Upload via SCP in binary mode. mkdir -p /var/nssnapshot && cd /var/nssnapshot # Only during initial setup: cp ns_quickcheck.conf.example ns_quickcheck.conf; cp ns_quickcheck.whitelist.example ns_quickcheck.whitelist chown root:wheel ns_quickcheck* && chmod 700 ns_quickcheck.sh && chmod 600 ns_quickcheck.conf ns_quickcheck.rules ns_quickcheck.whitelist sh ns_quickcheck.sh # Report and JSON located at /var/nssnapshot/quickcheck/ echo EXIT=$? # 0 OK, 1 INVESTIGATE, 2 UPDATE or FORENSICS_FIRST, 3 Abort
Read the last few lines first: ACTION and RESULT. Before running the program for the first time on a new appliance, refer to the section on the first run (7a) in the Documentation Read; on the first run, you can expect two to five rule or whitelist entries per appliance type.
What "OK" Means
"OK" means: The build has been fixed, no known indicators were triggered, and there are no traces in the window. It does not mean that the appliance is clean.
The Quickcheck is pattern-based. An attacker using paths or names that no one has yet published will remain undetected by any rule-based scan. If the appliance was exposed prior to the fix, we recommend the vendor’s IoC scan as an independent second opinion: the Indicators of Compromise feature in the NetScaler Console or, if you don’t have the Console, the Citrix Support scanner.
Additional limitations: Stock states in Block 5 are derived from 14.1; yellow findings are expected for 13.1 and FIPS on the first run.
NetScaler Integrity Baseline
Check. Record. Compare.
The Quickcheck is Part 1 of 3. It runs independently. Snapshot and Collector extend it to include time series and centralized analysis and are available upon request.
AVAILABLE
netscaler-quickcheck
Triage on the appliance using Verdict. With --compare Comparison with the latest snapshot: Web files, Cron, Listener, Config.
UPON REQUEST
netscaler-snapshot
Daily file snapshot per appliance, including a manifest and SHA-256 hash, along with the status of processes, listeners, cron jobs, and the current configuration. Lab-validated on 1/14.
BETA
netscaler-collector
In development. PowerShell 7 collector outside the appliance: import, daily diff with classification, traffic light report, IoC rescan over 90 days.
The "
" Project
Four bulletins. Four weeks. One tool.
netscaler-quickcheck was created in October 2026. It ran as a beta on lab and customer gateways starting October 7, and was released on GitHub on October 21.
In late September 2026, a series of critical security advisories began for NetScaler operators:
- September 27. CTX697096
, among others: CVE-2026-88771, pre-authentication RCE, CVSS 9.5, actively exploited; CVE-2026-88772, DTLS RCE - Oct. 3. CTX697174
CVE-2026-88779, SAML DoS, in the CISA catalog of exploited vulnerabilities - Oct. 8, CTX697191
CVE-2026-107406, SAML Memory Overflow, CVSS 9.5, no workaround - Oct. 22. CTX697263
CVE-2026-109618 and 109619, PHP in the Management Portal - ongoing updates
An update answers only one question: Has the vulnerability been fixed? It doesn't say whether anyone had already gained access to the appliance. The Quickcheck was created to address this second question.
Built for the next bulletin. The goal was to be better prepared next time. That’s why the two AI prompts used to generate rules are openly available in the repository. This allows even administrators without in-depth NetScaler knowledge to quickly create a rule from a new bulletin. Every rule patch undergoes the same checks as ours: syntax, source for each value, duplicates, and test logs.
The design, code, test data, and documentation were created with an AI assistant (Claude from Anthropic) as a collaborator. This was intentional: We wanted to show that defenders can work at the same pace as attackers who use the same tools.
What the AI didn't decide: what counts as evidence. Every indicator in the rule file is attributed to its original publisher. Every change runs through the test suite. Every finding described here was tested on actual appliances before it became a rule.
The Force isn't just strong on the dark side.
May the Force be with you—and with your gateways.
Jens Miltenberger
Author and Maintainer
Director of Consulting Services, ceterion AG. Has been working with Citrix appliances since 2004, from the Net6 Access Gateway to today’s ADC and gateway builds. The Quickcheck runs daily on lab and customer gateways; the findings underlying the rules and test data come from these runs.
Support from ceterion
Implement. Organize. Operate.
The Quickcheck works entirely on its own. If you need guidance or more time, we're here to help in three ways.
INTRODUCTION
"We want to use the Quickcheck."
We'll set up the read-only service user, guide you through the first run for each appliance type, and work with you to classify every red and yellow line. Confirmed statuses are added to your whitelist. You'll receive a summary for IT leadership and management.
Fixed-Price Package, Scope Based on the Number of Appliances
CLASSIFICATION
"The QuickCheck shows red or yellow."
We evaluate your findings based on the anonymized reports, provide clear recommendations for action, and, in cases of suspected issues, coordinate with Citrix Support. If a forensic investigation is necessary, we bring in specialized partners.
Flat fee per classification or as a quota
OPERATIONS
"We want this to be permanent."
Daily snapshot, centralized analysis using the Collector, rule maintenance in response to new Citrix bulletins, and a monthly traffic-light report. Documented and repeatable, also serving as evidence for audits and regulatory oversight.
Current Contract
Free initial assessment: Please send us the anonymized report from your first run (_anon.txt, _anon.json). We'll get back to you with a brief assessment—one per organization. We don't need the original data from your appliances for this.
Please check a sample before sending: External host and user names in log lines remain in plain text.
DIRECT CONTACT
We respond personally
Questions and Initial Run Reports:
netscaler-integrity@ceterion.com
Please send only the anonymized versions (_anon.txt, _anon.json), never the original report.
Security vulnerabilities in the script:
security@ceterion.com, never reported as a public issue
False Alarms and Overlooked Indicators:
Issue on GitHub
A verdict does not constitute approval. Even after our assessment, the following still applies: OK This means that no known indicator was met. It does not mean that the appliance is clean.
Questions? We are happy to help.
Find quick answers here – or feel free to contact us directly.
Nothing. The tool is open source under the Apache License 2.0 and may also be used commercially. It is provided "AS IS," without warranty.
No. It does not establish a network connection, does not modify any configuration or system files, and writes only to its own directories under /var/nssnapshot/.
Validated on NetScaler 14.1 (73.41 and 73.46). 13.1 and FIPS are in beta: The CVE table and log checks remain unchanged; for the stock states in Block 5, yellow findings are to be expected on the first run.
No. It complements it. For an appliance exposed prior to the fix, we recommend both: the Quickcheck for triage and time series analysis, and the vendor’s IoC scan as an independent second opinion. A verdict is no substitute for a forensic investigation.
When new Citrix bulletins are released, a new rule set appears in the repository. Administrators maintain their own indicators and fix builds in a custom file, which is not replaced during updates.
Yes, but only the anonymized versions. Each run generates them automatically: account and host names are masked, while attacker values are retained, with a consistent mapping for each appliance. The mapping table remains on the appliance and is never shared. Check a sample before sending: third-party host and user names in log lines remain in plain text.
Field names, verdicts, and the RESULT-The lines are language-neutral and documented in English so that SIEM, SOC, and non-German-speaking readers can work with them. An English version of the findings is planned.
netscaler-quickcheck is released by ceterion AG under the Apache License 2.0 and is provided "AS IS" without warranty (Disclaimer). A verdict does not replace a forensic investigation or a statement from the manufacturer.
Citrix and NetScaler are trademarks of Cloud Software Group, Inc. netscaler-quickcheck is not a product of Cloud Software Group and is neither supported nor tested by it.