A lot of people asked me the last couple of days how I was able to so quickly get the information from the NetScaler attacks. The answer is that I built my own MCP server for it. I took many hours this weekend to scrub, optimize, and update it for the community. It talks to the appliance over NITRO, plus a locked-down SSH path for nsconmsg counters and core dumps. I leaned on it hard during the CVE this weekend. Used it to piece together what actually happened, write and verify the v2 responder policy (including checking it was bound on every Gateway and auth vserver), and dig through the nsaaad core dump. Saved me a lot of hours. It's read-only by default. The NetScaler accounts you give it decide what it can do, so your helpdesk gets a read account and your admins get the write and forensic tools. Tested on 13.1. github.com/RyanGallier/netscaler-mcp-oss MIT licensed. Be easy on it, and let me know what breaks.

Ryan was kind enough to give me early access.. can confirm this is AMAZING!!!

you're welcome. Happy to contribute, as always. Was fun to work on too. I will be building a 14.1 today and testing it. I would assume it works fine with it, but need to validate for sure

just got this going....so, so good! endless capability. Thank you @Ryan Gallier!

you're welcome!

So when I‘m an MSP with 30 VPX, how does it talk to them? To each one individually I guess?

yeah, you put all the information in a config file, like NS_client1_mcp