##
.
This script not only identifies the memory leak vulnerability but **demonstrates real-world impact** by parsing sensitive data like session cookies and credentials directly from leaked memory.
`CVE-2025-5777` is a **critical memory leak vulnerability** in **NetScaler (Citrix) ADC and Gateway** products.
> 🧨 It allows unauthenticated, remote attackers to **leak sensitive memory content** like:
This can result in **full account takeover** without credentials or MFA, making it a **high-impact RCE-level vulnerability**.
→ Built with `asyncio` & `aiohttp` to scan targets blazing fast.
→ Parses **human-readable strings** from leaked memory (like creds, tokens).
→ Detects critical patterns like session cookies and flags high-risk data.
→ Automatically stores leaks into `leaks.txt` for clean offline analysis.
→ Supports one-time check or continuous exploitation mode with `--check` flag.
> ❗ **This tool is for educational and authorized bug bounty testing only.**
> ❌ Unauthorized use on systems you don’t own or have permission to test is **illegal**.
> 🧑💻 The author is not responsible for any misuse or damage caused by this tool.
* http.html:"_ctxstxt_NetscalerAAA" ssl.cert.subject.CN:"target.com" port:6443
* title:"Netscaler Gateway" ssl.cert.subject.CN:"target.com" port:6443
* title:"NetScaler AAA" ssl.cert.subject.CN:"target.com" port:6443
* http.favicon.hash:-1166125415 ssl.cert.subject.CN:"target.com" port:6443
* http.favicon.hash:-1292923998 ssl.cert.subject.CN:"target.com" port:6443
* inurl:/logon/LogonPoint/tmindex.html site:target.com
curl -s -k -X POST " -d "login"
Exploit Payload Path ` Use Burp Suite to capture and manipulate the request.
* Tool Developer: Virendra Kumar & CyberLeelawat
* Original Vulnerability Research: The foundational research and original exploit concepts for this vulnerability were published by security researchers at Watchtwr Labs and others in the community. This tool builds upon their essential work.
📜 License This project is licensed under the MIT License – see the LICENSE file for details.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
