The NITRO simulator supports login/logout cookies, configuration and statistics resource routes,
named reads, fake POST/PUT/DELETE operations, enable/disable/rename acknowledgements, bindings,
`attrs`, literal `filter`/`args`, counts and pagination. Its catalog recognizes 1,493 configuration
names and 176 statistics names from the [official 14.1 reference](https://developer-docs.netscaler.com/en-us/adc-nitro-api/current-release/configuration/). Common appliance, network,
Gateway, AAA, load-balancing, SSL and binding resources have populated synthetic data;
unconfigured resources return empty collections. This is a protocol simulation, not a complete
implementation of every resource's schema or firmware behaviour. Fake changes are bounded,
per-source memory only and expire with sessions; NAT can merge clients. `HONEYPOT_VERSION`
controls the invented firmware banner. Uploaded files never become operating-system files
at submitted paths and are never served publicly.
JSON `systemfile.filecontent` uploads are base64-decoded into inert artifacts while preserving
the original JSON body too. Binary, multipart, chunked and rejected-request evidence is retained
by the existing capture layer. Files are committed with atomic rename and directory fsync;
an interrupted journal tail is preserved separately from subsequent records.
The supplied systemd unit restarts ordinary service crashes after five seconds. Enable VM
autostart separately when deploying on a hypervisor. Storage/capture failure
sets an evidence-directory `STOP` latch and exits78, preventing automatic restart. Review
storage and preserve captured evidence before explicitly clearing that latch. Capture has a
configurable evidence quota, a 16MiB request-body limit and eight concurrent requests. Cloudflare/NPM
may reject or normalize traffic before it reaches the collector; unread/rejected bytes beyond
“Captured” means evidence is retained within the limits below. It does not mean a real
vulnerability exists, a payload executes, or a CVE is conclusively identified.
| Input surface | Capture and analysis capability |
| --- | --- |
| HTTP methods and request targets | GET, HEAD, POST, PUT, DELETE, OPTIONS and other parsed method names; original URI/query and HTTP version. Unknown routes still accept body capture before returning404. Method support in simulated APIs is narrower. |
| Headers and cookies | Raw header pairs, including duplicates that reach the collector, User-Agent, Cookie, custom headers and proxy evidence aliases. Crash-log markers, encoding hints and headers over8KiB produce private hunt labels. |
| URL/query probes | Traversal/encoded traversal, appliance-configuration paths, management paths and SAML query fields. Original URI is retained independently of decoded indicators. |
| URL-encoded forms | Original body plus decoded field pairs, login/password submissions and SAML envelopes. Fields can feed the bounded textual command simulator. |
| Multipart forms/uploads | Original multipart body, individual field/file bytes, submitted filename, field name, MIME type and parser defects. Filenames are metadata, never host paths. |
| JSON/API payloads | Original JSON bytes; NITRO systemfile.filecontent additionally becomes a base64-decoded file artifact. Other JSON is captured even if not recognized by the simulator. |
| Binary/raw uploads | Exact accepted body bytes regardless of executable format or extension; content-addressed inert storage. No malware execution or unpacking. |
| Chunked requests | Accepted chunked bodies are decoded for body artifacts; consumed origin framing and accepted trailers remain separate evidence. Proxy framing may differ from the client connection. |
| SAML POST/Redirect bindings | SAMLRequest/SAMLResponse base64 artifacts from forms and queries, plus bounded raw-DEFLATE expansion for query bindings. Invalid encodings/limits are recorded; no XML parsing or authentication. |
| Malformed/interrupted requests | Rejection/interruption events and consumed partial wire bytes where available. Unread bytes and requests rejected at the edge cannot be recovered. |
| Outbound-command intent | Recognized network-tool commands in the textual simulator are recorded as outbound attempts; strict capture-only mode makes no connection or download. |
| Gateway static fingerprints | Explicit rdx/CTXS JavaScript routes, login.js/init.js, original favicon/logo/background assets and AccessGateway.ico alias. Only routes in STATIC are supported; arbitrary files under these directories return404. |
| Language/version fingerprints | English/German JSON and `.json.gz` under `/vpn/js/rdx/core/lang/` and `/vpn/js/rdx/core/lang-ext/`; gzip filename, build timestamp, Content-Encoding and Last-Modified. Synthetic translation subset with the default14.1-29.63 metadata. |
| Authentication XML | `/nf/auth/*` returns credential requirements, state context and local postback. This is a repeated login challenge, not LDAP, SAML, MFA or successful real authentication. |
| NITRO authentication | `/nitro/v1/config/login` and logout with synthetic session tokens. Resource access accepts a matching fake token, nonempty X-NITRO-USER/X-NITRO-PASS, or a Basic authorization prefix. These are decoy rules, not real user/account validation. |
| NITRO resources | `/nitro/v1/config/<resource>[/<name>]` and `/nitro/v1/stat/<resource>[/<name>]`;1,493 config and176 statistics names in [nitro-resources.json](nitro-resources.json). Common system/network/Gateway/AAA/SSL/LB/binding records are populated; other recognized resources return empty collections or generic counters. |
| Textual command simulation | Approximate log-poisoning marker extraction from URI, headers and decoded form fields. Bounded shell-like grammar supports id, whoami, uname, pwd, cd, cat, ls, echo, selected printf formats, touch, rm and simple redirects in per-source memory. mkdir/true/colon are acknowledgements; unsupported commands are recorded. No real shell or filesystem access. |
| Private/uploaded paths | The supplied public service uses --hide-guest-files: evidence, source, viewer and uploaded files are not served by the honeypot. Unknown `.env`, PHP, GraphQL and other application paths return404 while incoming requests remain captured. |
### CVE/vector coverage status
This matrix describes collection and simulation coverage, not an exploit implementation or
a guarantee of detecting every variant. Generic indicators must be corroborated manually.
| Advisory/vector | Current coverage |
| --- | --- |
| CVE-2019-19781 | Conservative Gateway/vpns path labels and raw traversal-request capture; no vulnerable template engine or actual traversal. |
| CVE-2026-88771 | HTTP header/form/URI capture, crash-log markers, approximate textual command extraction and inert responses. No real log-to-shell execution or full multi-stage chain emulation. |
| CVE-2026-19490 | Gateway/AAA and SAML-envelope intake; no real authentication-bypass reproduction or dedicated definitive CVE signature. |
| CVE-2026-88779 | SAML original/decoded evidence with bounded inflation; no SAML SP/IdP engine, memory-overflow reproduction or dedicated definitive CVE signature. |
| CVE-2026-88773 /88774 /88775 | Generic HTTP framing, URL and size-related evidence where it reaches the collector. No NetScaler request-smuggling, policy engine or memory-corruption emulation. |
| CVE-2026-88772 | DTLS/UDP collection is not implemented or active; HTTP follow-up requests can still be captured. |
| CVE-2026-19489 /88776 /88777 /88778 | SIP ALG, Oracle/non-HTTP protocol and TCP sequence-number behavior are not emulated. |
| Other Citrix vectors, including CitrixBleed | HTTP requests can be retained, but unlisted vectors have no promised dedicated detector or vulnerable response simulation. No real memory or session-secret disclosure. |
