iot-camera-recon

1# IoT Camera Recon Skill
2 
3IP camera assessment covering RTSP exposure, vendor configuration endpoints,
4ONVIF service enumeration, authentication controls, and firmware
5identification.
6 
7## When to Use
8 
9- `port-mass-scan` finds RTSP (554) or camera HTTP ports (80, 8010, 8011).
10- Target is a physical security company, traffic management, or government surveillance.
11- Shodan search reveals camera devices in the target's IP range.
12- After `port-service-discovery` finds Axis/Hikvision/Dahua ONVIF services.
13 
14## Prerequisites
15 
16- `terminal` with curl, python3.
17- For mass scanning: masscan or RustScan (see `port-mass-scan`).
18- VLC or ffmpeg for stream verification (optional).
19 
20## How to Run
21 
22```bash
23# Quick camera detection on known IP
24curl -sk --max-time 5 --connect-timeout 5 "http://IP:8010/axis-cgi/jpg/image.cgi" -o snapshot.jpg
25curl -sk --max-time 5 --connect-timeout 5 "http://IP:8010/axis-cgi/admin/param.cgi?action=list" | head -50
26 
27# Mass RTSP discovery on a /24
28masscan -p554,80,8010,8011 --rate=10000 192.168.0.0/24 -oJ cameras.json
29```
30 
31## Quick Reference
32 
33| Camera Brand | Default HTTP Port | Snapshot URL | Config URL | Default Creds |
34|-------------|-------------------|-------------|------------|---------------|
35| Axis | 80, 8010 | `/axis-cgi/jpg/image.cgi` | `/axis-cgi/admin/param.cgi?action=list` | root:pass, root:admin |
36| Hikvision | 80, 554 | `/ISAPI/Streaming/channels/101/picture` | `/System/configurationFile?auth=...` | admin:12345, admin:admin |
37…