Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Interception of Citrix Netscaler traffic

Imre | Last updated: Apr 27, 2015 04:57PM UTC

I am testing an application that tunnels traffic through a Citrix NetScaler connection and so far have had no success in defeating certificate validation. Evidently, Citrix requires a certificate with the "serverAuth" extendedKeyUsage field enabled. Providing this requires generation of a new CA certificate with this attribute. According to Citrix, the following configuration works when generating certificates for NetScaler appliances, which ***should*** also work with Burp: [req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = VA L = SomeCity O = MyCompany OU = MyDivision CN = www.company.com [v3_req] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = www.company.net DNS.2 = company.com DNS.3 = company.net I used the following to create the CA cert and private key in DER format that Burp requires: #req -x509 -days 730 -nodes -newkey rsa:2048 -outform der -keyout server.key -out ca.der -config /etc/ssl/req.conf #openssl rsa -in server.key -inform pem -out server.key.der -outform der #openssl pkcs8 -topk8 -in server.key.der -inform der -out server.key.pkcs8.der -outform der -nocrypt Although I can successfully import the certificate and key into Burp, browsers never accept any certificate that the CA generates, complaining about "Certificate key usage inadequate for attempted operation". Has anyone had any success in doing this? Thanks - M

| Last updated: Jan 29, 2022 07:36PM UTC

Did you ever make any progress with this? I'm trying to just successfully connect and configure Burp to use a squid proxy when connecting to the Citrix Netscaler gateway. I'd like to be able to perform password spray attacks against the login interface and can't even successfully connect if I use the squid proxy.

Liam, PortSwigger Agent | Last updated: Jan 31, 2022 07:47AM UTC

Hi Richard. From a quick look through our archives, it doesn't look like anyone has asked about / had success with Citrix Netscaler. We'll follow up on your other forum post.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.