Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-20198-Scanner — This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273 | Kitploit
Tools/GitHubGitHub/shadow0ps/cve-2023-20198-scanner
Indicator of Compromise (IOC) ManagementVulnerability ScannersExploitationInformation GatheringWeb SecurityNetwork Security
GitHubshadow0ps/cve-2023-20198-scanner

CVE-2023-20198-Scanner

This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273

View Repository
3362 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Cisco IOS XE Device Scanner User Guide for CVE-2023-20198-Scanner

This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273. This Python script checks for compromised Cisco IOS XE devices by making HTTP and HTTPS requests. It supports multiple ways to specify target IPs and provides threading for faster scanning.

ChangeLog

  • Added new Authentication NGINX Configuration file from Talos Security's blog
  • Added Explainer for configuration LUA script functionality.
  • Added CURL from Talos Blog along with Authorization HEX value provided by Talos Security.

A few things you can do with this scipt:

  • Scan a Single IP
  • Scan a list of IP's (Provide a file with each IP on a new line and pass it via argument)
  • Scan a CIDR range
  • Specify a custom UserAgent
  • Specify new IOC's within the response.text using a file (IOCS.txt is the default file. Ensure each IOC is on a new line.) *Known IOCS will be updated regularly should new ones become known. All current IOC's are already implemented directly into the code for clarity.
Ability to specify a proxy for scans
  • Concurrent Processing for speed and efficiency.
  • Rate Limiting
  • Logging of compromised hosts.
  • Visual indication of potentially compromised hosts vs "clean" hosts. - This is not a guarantee and is based strictly off the known IOC's.

    • Requirements

    • Python 3.x
    • Required Python packages: requests, termcolor, tqdm

    Install the required Python packages using pip if you haven't already:

    root@kitploit:~
    pip install requests termcolor tqdm

    Usage

    The script provides several command-line options for flexibility:

    --target_file

    Specify a file containing a list of Cisco IOS XE Device IPs or hostnames. The IPs or hostnames should be listed one per line.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --target_file targets.txt

    --cidr

    Specify a CIDR range to scan. The script will generate all the IPs in the specified range and scan them.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --cidr 192.168.1.0/24

    --ip

    Specify a single IP to scan.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --ip 192.168.1.1

    --user_agent

    Set a custom User-Agent header for the HTTP requests. The default is CISCO-IOS-Shell-Scanner-cisco-sa-iosxe-webui-privesc-j22SaA4z.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --user_agent "MyCustomUserAgent"

    --rate_limit

    Set a rate limit in seconds between requests. The default is 1 second.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --rate_limit 0.5

    --proxy

    Specify an HTTP Proxy to use for requests.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --proxy http://127.0.0.1:8080

    --iocs_file

    Specify a file containing Indicators of Compromise (IoCs) to look for in the response text. The default is IOCS.txt.

    Example:

    root@kitploit:~
    python iosxe-scanner.py --iocs_file custom_iocs.txt

    Examples

    Scan a list of targets from a file with a rate limit of 0.5 seconds

    root@kitploit:~
    python iosxe-scanner.py --target_file targets.txt --rate_limit 0.5

    Scan a CIDR range using a proxy

    root@kitploit:~
    python iosxe-scanner.py --cidr 192.168.1.0/24 --proxy http://127.0.0.1:8080

    Scan a single IP with a custom User-Agent

    root@kitploit:~
    python iosxe-scanner.py --ip 192.168.1.1 --user_agent "MyCustomUserAgent"

    Scan using a custom IoCs file

    root@kitploit:~
    python iosxe-scanner.py --iocs_file custom_iocs.txt

    Notes

    • This script disables SSL certificate verification for making HTTPS requests. Use this feature cautiously.
    • This script is presented "As Is" with NO WARRANTY. USE AT YOUR OWN RISK!
    • Use of this script may be illegal in your country or jurisdiction. While it only makes simple HTTP(S) requests and checks for specific responses it's up to you to determine whether or not its use is legal/ethical and appropriate. DONT BE A JERK.

    If you find this script useful feel free to let me know or give me a follow on Twitter(𝕏) https://twitter.com/shadow0pz

    Download Tool