scada-hikvision-isapi

1# SCADA Hikvision ISAPI Enumeration
2 
3Enumerate Hikvision ISAPI (Intelligent Security Application Programming Interface) endpoints on industrial control and surveillance web interfaces. Hikvision devices and HikCentral Professional deployments expose a rich REST/XML API at predictable paths. While most endpoints require authentication (CAS session token, Basic auth, or Digest auth), unauthenticated enumeration reveals the device type, firmware baseline, available modules, and potential attack surface. JavaScript bundles often contain the full ISAPI route tree.
4 
5## When to Use
6 
7- A web interface on a non-standard port (443, 8443, 9443) loads a large JavaScript bundle with references to `/ISAPI/`, `Bumblebee`, or `Streaming/channels`.
8- Port scan reveals RTSP (554), ONVIF (8899), or Hikvision-specific ports (8000, 9010).
9- The server header or SSL certificate references Hikvision, HikCentral, iVMS, or Pyramid.
10- A target has industrial/energy/infrastructure context where SCADA systems are likely.
11- The web client loads `Common/common.js`, `Common/components.js`, or `Common/vendorGraph.js` from a relative path.
12 
13## Prerequisites
14 
15- `terminal` with curl, python3, and nmap.
16- Access to the web interface (even without authentication).
17- The target serves JavaScript bundles — download them for endpoint extraction.
18 
19## How to Run
20 
21```bash
22# Fingerprint the web interface
23curl --max-time 30 --connect-timeout 10 -skI "https://TARGET:PORT/" | grep -iE "server|x-powered"
24…