Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2023-4966-iocs — Python script to search Citrix NetScaler logs for possible CVE-2023-4966 exploitation. | Kitploit
Tools/GitHubGitHub/jmussmann/cve-2023-4966-iocs
Indicator of Compromise (IOC) ManagementVulnerability AnalysisForensicsNetwork SecurityIncident ResponseLog Analysis
GitHubjmussmann/cve-2023-4966-iocs

cve-2023-4966-iocs

Python script to search Citrix NetScaler logs for possible CVE-2023-4966 exploitation.

View Repository
52 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Scan for CVE-2023-4966 IoCs

Script: check-cve-2023-4966.py

The script searches the Citrix NetScaler logs for possible CVE-2023-4966 exploitation.

Usage

root@kitploit:~
usage: check-cve-2023-4966.py [-h] [--nologline] logdir_path

Python script to check CitrixNetScaler logs for possible CVE-2023-4966 exploitation

positional arguments:
  logdir_path  path to NetScaler log files (located on the NetScaler in the directory /mnt/temp/log/)

options:
  -h, --help   show this help message and exit
  --nologline  do not print the logline

Example

root@kitploit:~
$ python check-cve-2023-4966.py NetScaler/log/mnt/temp/log/ --nologline
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345
Logpath NetScaler/log/mnt/temp/log/ns.log.4.gz User: user1 Client_ip: XXX.XXX.XXX.XXX Source_ip YYY.YYY.YYY.YYY Session_id: 12345

Citrix XenDesk/XenApp Monitoring Database

Citrix XenDesk and XenApp sessions are logged in the monitoring database. With this monitoring database it is possible to find the sessions and worker machines which might be used after successful exploitation.

The helper directory contains sql queries to check the monitoring database.

machines.sql

Script to get the machine id, name and ip address.

last-sessions.sql

Query to get sessions from a specific machine (MachineId).

session query

Query to get additionl sessions information for a specific machine (MachineId) and user.

Download Tool