Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Interception of Citrix Netscaler traffic

Imre | Last updated: Apr 27, 2015 04:57PM UTC

I am testing an application that tunnels traffic through a Citrix NetScaler connection and so far have had no success in defeating certificate validation. Evidently, Citrix requires a certificate with the "serverAuth" extendedKeyUsage field enabled. Providing this requires generation of a new CA certificate with this attribute. According to Citrix, the following configuration works when generating certificates for NetScaler appliances, which ***should*** also work with Burp: [req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = US ST = VA L = SomeCity O = MyCompany OU = MyDivision CN = www.company.com [v3_req] keyUsage = keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1 = www.company.net DNS.2 = company.com DNS.3 = company.net I used the following to create the CA cert and private key in DER format that Burp requires: #req -x509 -days 730 -nodes -newkey rsa:2048 -outform der -keyout server.key -out ca.der -config /etc/ssl/req.conf #openssl rsa -in server.key -inform pem -out server.key.der -outform der #openssl pkcs8 -topk8 -in server.key.der -inform der -out server.key.pkcs8.der -outform der -nocrypt Although I can successfully import the certificate and key into Burp, browsers never accept any certificate that the CA generates, complaining about "Certificate key usage inadequate for attempted operation". Has anyone had any success in doing this? Thanks - M

| Last updated: Jan 29, 2022 07:36PM UTC

Did you ever make any progress with this? I'm trying to just successfully connect and configure Burp to use a squid proxy when connecting to the Citrix Netscaler gateway. I'd like to be able to perform password spray attacks against the login interface and can't even successfully connect if I use the squid proxy.

Liam, PortSwigger Agent | Last updated: Jan 31, 2022 07:47AM UTC