CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

ui/login.html

@@ -0,0 +1,64 @@
+<!doctype html>
+<html lang="de">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex, nofollow">
+  <title>NetScaler AAA</title>
+  <link rel="icon" href="/logon/LogonPoint/receiver/images/common/icon_vpn.ico" sizes="16x16 32x32 48x48 64x64" type="image/vnd.microsoft.icon">
+  <link rel="shortcut icon" href="/logon/LogonPoint/receiver/images/common/icon_vpn.ico" type="image/vnd.microsoft.icon">
+  <style>
+    * { box-sizing: border-box; }
+    html, body { min-height: 100%; margin: 0; }
+    body { background: #302c41 url('/logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg') center / cover fixed;
+      font-family: "Helvetica Neue", "Segoe UI", Helvetica, Arial, sans-serif; color: #fff; }
+    main { min-height: 100vh; display: flex; align-items: center; }
+    .band { width: 100%; min-height: 350px; background: rgba(58, 54, 65, .86); display: flex; align-items: center; }
+    .layout { width: min(1086px, calc(100% - 64px)); margin: auto; display: grid; grid-template-columns: 258px 570px; align-items: center; }
+    .logo { width: 160px; height: auto; }
+    h1 { font-size: 18px; font-weight: 400; margin: 0 0 18px; }
+    .row { display: grid; grid-template-columns: 185px 1fr; align-items: center; margin-bottom: 6px; }
+    label { color: #bdbbc2; font-size: 16px; }
+    input { width: 100%; height: 44px; border: 1px solid #ddd; background: white; color: #111; border-radius: 0; padding: 8px 15px; font: inherit; }
+    input:focus-visible { outline: 2px solid #79cce2; outline-offset: 2px; }
+    button { display: block; width: calc(100% - 185px); margin: 26px 0 0 185px; height: 45px; border: 0; border-radius: 0;
+      background: #49a0bb; color: white; font: 600 16px "Helvetica Neue", "Segoe UI", Helvetica, Arial, sans-serif; cursor: pointer; }
+    button:hover { background: #398aa4; }
+    button:focus-visible { outline: 2px solid white; outline-offset: 3px; }
+    button:disabled { cursor: wait; opacity: .75; }
+    #message { margin: 12px 0 0 185px; font-size: 14px; color: #fff; }
+    #message:empty { display: none; }
+    @media (max-width: 950px) {
+      .layout { width: min(570px, calc(100% - 48px)); display: block; padding: 40px 0; }
+      .logo { margin-bottom: 28px; }
+    }
+    @media (max-width: 540px) {
+      .row { display: block; margin-bottom: 16px; }
+      label { display: block; margin-bottom: 7px; }
+      button { width: 100%; margin-left: 0; }
+      #message { margin-left: 0; }
+    }
+  </style>
+  <script src="/vpn/js/rdx.js"></script>
+  <script src="/vpn/js/gateway_login_view.js"></script>
+  <script src="/logon/LogonPoint/login.js" defer></script>
+  <script>var _ctxstxt_CitrixCopyright = 'Copyright (c) Citrix Systems, Inc.';</script>
+</head>
+<body>
+  <main>
+    <section class="band" aria-label="Citrix Gateway">
+      <div class="layout">
+        <img class="logo" src="/vpn/media/citrixgateway_logo_white.png" alt="Citrix Gateway">
+        <form id="login-form" method="post" action="/nf/auth/doAuthentication.do" autocomplete="off">
+          <h1>Melden Sie sich an</h1>
+          <div class="row"><label for="login">Benutzername:</label><input id="login" name="login" required autofocus autocomplete="off" spellcheck="false"></div>
+          <div class="row"><label for="passwd">Kennwort:</label><input id="passwd" name="passwd" type="password" required autocomplete="off"></div>
+          <input type="hidden" name="savecredentials" value="false">
+          <button id="nsg-x1-logon-button" name="nsg-x1-logon-button" value="Log On" type="submit">Anmelden</button>
+          <p id="message" role="status" aria-live="polite"></p>
+        </form>
+      </div>
+    </section>
+  </main>
+</body>
+</html>

ui/login.js

@@ -0,0 +1,24 @@
+'use strict';
+const form = document.getElementById('login-form');
+const button = document.getElementById('nsg-x1-logon-button');
+const message = document.getElementById('message');
+form.addEventListener('submit', async event => {
+  event.preventDefault();
+  button.disabled = true;
+  message.textContent = '';
+  try {
+    const body = new URLSearchParams(new FormData(form));
+    body.set('nsg-x1-logon-button', 'Log On');
+    const response = await fetch('/nf/auth/doAuthentication.do', {
+      method: 'POST', body, credentials: 'same-origin', redirect: 'error',
+      signal: AbortSignal.timeout(10000)
+    });
+    if (!response.ok) throw new Error('Request failed');
+    message.textContent = 'Anmeldung fehlgeschlagen. Überprüfen Sie Ihre Zugangsdaten.';
+  } catch {
+    message.textContent = 'Die Anmeldung ist derzeit nicht möglich. Versuchen Sie es erneut.';
+  } finally {
+    form.elements.passwd.value = '';
+    button.disabled = false;
+  }
+});

ui/sources.json

@@ -0,0 +1,19 @@
+{
+  "retrieved": "2026-09-28",
+  "reference": "public Citrix Gateway (NetScaler) login page static assets, retrieved 2026-09-28",
+  "assets": {
+    "background.jpg": {
+      "sha256": "17197024d7ccdb50bd23b0e4cfcd38bf818f0c1644795474460bb1b5c95906d5",
+      "bytes": 50806
+    },
+    "logo.png": {
+      "sha256": "4a2cae9a9c5a586f2bd5dc6140e34cac6b18be6b617c602a4a48321452c18c1c",
+      "bytes": 2300
+    },
+    "favicon.ico": {
+      "sha256": "80c297534c925e1973052b72584a929a0b68c988bfcde7c1728ad72fc1f3e039",
+      "bytes": 32038
+    }
+  },
+  "note": "Original public static images; HTML and JS locally implemented. No upstream auth or session tokens retained."
+}