dissect.target.plugins.apps.webserver.citrix

Module Contents

Classes

CitrixWebserverPlugin

Apache log parsing plugin for Citrix specific logs.

Attributes

LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME

LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS

dissect.target.plugins.apps.webserver.citrix.LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME
dissect.target.plugins.apps.webserver.citrix.LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS
class dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.apps.webserver.apache.ApachePlugin

Apache log parsing plugin for Citrix specific logs.

Citrix uses Apache with custom access log formats. These are:

LogFormat "%{Citrix-ns-orig-srcip}i -> %{Citrix-ns-orig-destip}i %l %u %t [%P] "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "Time: %D microsecs"" combined_resptime_with_citrix_hdrs
LogFormat "%a %l %u %t [%P] "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "Time: %D microsecs"" combined_resptime
__namespace__ = 'citrix'
ACCESS_LOG_NAMES
ERROR_LOG_NAMES
check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

static infer_access_log_format(line: str) → dissect.target.plugins.apps.webserver.apache.LogFormat

Attempt to infer what standard LogFormat is used. Returns None if no known format can be inferred.

Three default log type examples from Apache (note that the ipv4 could also be ipv6)

Combined:

1.2.3.4 - - [19/Dec/2022:17:25:12 +0100] "GET / HTTP/1.1" 304 247 "-" "Mozilla/5.0
            (Windows NT 10.0; Win64; x64); AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0
            Safari/537.36"

Common:

1.2.3.4 - - [19/Dec/2022:17:25:40 +0100] "GET / HTTP/1.1" 200 312

vhost_combined:

example.com:80 1.2.3.4 - - [19/Dec/2022:17:25:40 +0100] "GET / HTTP/1.1" 200 312 "-"
"Mozilla/5.0 (Windows NT 10.0; Win64; x64); AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/108.0.0.0 Safari/537.36"