Citrix Enumeration
> Default Domain
> Published Applications
./citrix-pa-scan {IP_address/file | - | random} [timeout] (http://www.cqure.net/tools/citrix_pa.zip)
citrix-pa-proxy.pl IP_to_proxy_to [Local_IP] (http://www.cqure.net/tools/citrix_pa.zip)

Citrix Brute Force
> bforce.js ( http://code.google.com/p/gobag/source/browse/trunk/citrix/bforce.js?r=2 )
> connect.js ( http://www.gnucitizen.org/static/blog/2007/10/connect.js )
> Citrix Brute-forcer ( http://sh0dan.org/oldfiles/citrix-pab/ )
> Reference Material
Hacking Citrix - the legitimate backdoor ( http://www.gnucitizen.org/blog/citrix-owning-the-legitimate-backdoor/ )
Hacking Citrix - the forceful way ( http://www.gnucitizen.org/blog/hacking-citrix-the-forceful-way/ )