iot-camera-recon

What problem does it solve?

Exposed IoT camera devices (RTSP, ONVIF, Axis, Hikvision, etc.) are a common high-risk vulnerability in physical security, traffic management, and government surveillance networks, often featuring unauthenticated configuration access, default credentials, and open video streams that attackers can exploit to gain unauthorized access to sensitive video feeds and internal network data.

Core Features & Use Cases

• Mass Camera Discovery: Scan target IP ranges for open RTSP (554), ONVIF (8899), and brand-specific HTTP ports (8010 for Axis, 80/554 for Hikvision/Dahua) using masscan to identify all exposed camera devices.
• Configuration & Stream Access: Extract unauthenticated configuration data from Axis cameras (including firmware version, serial number, and sensitive parameters) and capture live snapshots or MJPG video streams from supported devices.
• Default Credential Testing: Automatically test common default credentials for all major camera brands to gain unauthorized access to protected device controls and video feeds.
• Use Case: During a red team engagement targeting a city's traffic management system, use this skill to identify 200+ exposed Engebras traffic radar cameras, extract their configuration data to map the internal network, and test default credentials to access live traffic feed streams.

Quick Start

Use the iot-camera-recon skill to scan the target IP range 192.168.1.0/24 for exposed camera devices, extract their configuration details, and test for default credentials to gain access to live video streams.