Onvifscan

Test ONVIF devices for unauthenticated access and weak credentials.

Updated Nov 23, 2025

Search Tags:#authentication #IoT #security scan #pentesting #brute force #ONVIF #camera

One-click install

npx skills add https://github.com/consigcody94/bounty-buddy --skill onvifscan

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: Onvifscan
Source: https://github.com/consigcody94/bounty-buddy/tree/main/.claude/skills/onvifscan
Command: npx skills add https://github.com/consigcody94/bounty-buddy --skill onvifscan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually assessing the security of ONVIF-enabled devices, such as IP cameras, for authentication bypasses and weak credentials can be a tedious and time-consuming process. This skill automates these security checks, quickly identifying vulnerabilities in ONVIF devices.

Core Features & Use Cases

Authentication Testing: Automatically tests ONVIF endpoints for unauthenticated access.
Credential Brute-Forcing: Attempts to discover weak or default credentials using built-in or custom wordlists.
Use Case: After discovering an ONVIF camera with wsdiscovery, use onvifscan to automatically check for default credentials or unauthenticated access to its video streams and configuration settings, providing immediate insights into its security posture.

Quick Start

Use the Onvifscan skill to perform an authentication check on the ONVIF device at '192.168.1.100' and output the results in JSON format.