scada-hikvision-isapi

What problem does it solve?

This Skill solves the problem of identifying hidden attack surface on Hikvision SCADA and IoT surveillance systems, where standard network scans fail to expose web-accessible ISAPI endpoints that can lead to unauthorized camera access, data leakage, or lateral movement in industrial networks.

Core Features & Use Cases

• JavaScript Bundle Endpoint Extraction: Automatically pulls ISAPI route trees from client-side JS files served by Hikvision web interfaces to uncover hidden API paths.
• Unauthenticated Endpoint Probing: Tests common ISAPI paths to identify live endpoints and decode error codes that confirm exposed services even without valid credentials.
• Credential and Streaming Access Testing: Checks for default admin credentials and attempts to access camera snapshots, RTSP streams, and sensitive configuration endpoints like user permission lists.
• Use Case: For a red team engagement targeting an energy sector client with Hikvision NVRs deployed on their industrial control network, use this Skill to quickly map all accessible ISAPI endpoints, test for default credentials, and identify unauthenticated access to live camera feeds or user permission data.

Quick Start

Use the scada-hikvision-isapi skill to enumerate all accessible Hikvision ISAPI endpoints on the target industrial web interface at https://target:port and test for unauthenticated access to camera snapshots and user permission data.