scada-hikvision-isapi

To enumerate Hikvision ISAPI endpoints, this skill parses JavaScript bundles and probes REST/XML API paths to map the complete attack surface of target web interfaces. It automatically extracts available API routes without requiring credentials.

Discovering exposed camera streams on Hikvision NVRs is done by unauthenticated probing of sensitive ISAPI endpoints, such as streaming channels and storage configurations, to identify exposed interfaces during security assessments.

Yes, you can fingerprint SCADA web interfaces using nmap and curl. This skill requires both tools alongside python3 to perform endpoint extraction and unauthenticated probing of REST/XML API paths on industrial control systems.

Extracting API routes from JavaScript bundles on IP cameras is automated by parsing the target web interface to map the complete API route tree. This process identifies all available endpoints without needing device credentials.

Unauthenticated probing works for testing exposed sensitive endpoints on Hikvision surveillance networks, but it is limited to discovering interfaces accessible without credentials. It applies to security assessments of industrial control systems and network-connected cameras.

Standard network scanning misses Hikvision ISAPI endpoints because they are often overlooked by general scanners. This skill specifically targets and automates the discovery of these REST/XML API paths on industrial and IoT web interfaces.