Surveillance Device Exploitation

IP Camera Hacking

Security cameras watch everything — and most of them are wide open. Default passwords, exposed RTSP streams, and auth bypass bugs mean attackers can see what the camera sees. Find the camera on our network and take control of its feed.

What You'll Learn

  • Discovering IP cameras with nmap and understanding their services
  • How Shodan exposes thousands of cameras to the entire internet
  • Brute-forcing web logins with common default credential lists
  • Accessing and pulling RTSP video streams
  • The privacy catastrophe of exposed cameras — and how to prevent it

Legal & Ethical Warning

Accessing someone's camera without permission is a serious crime — voyeurism, wiretapping, and computer intrusion charges can all apply. Sites that aggregate hacked camera feeds are run by criminals, and their users get prosecuted. This room uses a fully simulated camera. Audit only your own equipment.

Theory

Camera Attack Surface

Why cameras are the most exposed devices on any network.

Shodan: The Camera Search Engine

Shodan indexes every device connected to the internet — not websites, devices. Search for common camera banners and you get hundreds of thousands of live results:

Real Shodan Dorks (Defensive Research)Shodan
# Find cameras with default web interfaces "Server: SQ-WEBCAM" "goahead" 200 ok camera "Basic realm=\"camera\"" port:554 "RTSP/1.0" Result: 500,000+ cameras visible to anyone with a browser.

This is why camera security matters so much — a misconfigured camera isn't just visible to the local network. It's visible to the entire planet.

The Default Credential Hall of Shame

These credential pairs open an embarrassing percentage of deployed cameras:

UsernamePasswordCommon Brands
adminadminD-Link, Foscam, generic OEM
admin12345Hikvision (old firmware)
admin(blank)Various OEM cameras
rootrootEmbedded Linux cams
adminpasswordBudget/no-name cameras
viewerviewerRead-only accounts

RTSP: The Video Protocol

Most IP cameras stream video over RTSP (Real Time Streaming Protocol) on port 554. The stream URL typically looks like:

RTSP Stream URLsRTSP
# Common RTSP path patterns rtsp://192.168.1.110:554/stream1 rtsp://192.168.1.110:554/h264/ch1/main/av_stream rtsp://admin:[email protected]:554/live # Play a stream with ffplay or VLC ffplay rtsp://192.168.1.110:554/stream1

Many cameras expose RTSP with no authentication at all — anyone on the network (or internet, if port-forwarded) can watch the feed.

Interactive Lab

Own the Office Camera

Find the camera at 192.168.1.110, break into its web interface, and pull the live feed.

Attacker Terminal (Simulated)

root@l2c-lab:~/cam-lab
Camera Exploitation Lab v1.0 — Target subnet: 192.168.1.0/24
Type 'help' for commands or follow the steps below.
root@l2c-lab:~#
Quick Commands
Find cameras (ports 80/554/8080)
Fingerprint the camera
Brute-force web login
Pull the live feed
LIVE
CAM-01 · Office Lobby · 192.168.1.110
UNAUTHORIZED ACCESS
CAM_01 /lobby/main
Simulated video feed — figure moving through lobby
2026-10-24 15:45:00

Lab Steps

1

Discover Cameras

Scan the subnet for camera ports: 80 (web UI), 554 (RTSP), 8080 (alt web).

nmap -p 80,554,8080 192.168.1.0/24 --open
2

Fingerprint the Device

Identify the camera model and software from its service banners.

nmap -sV -p 80,554 192.168.1.110
3

Brute-Force the Web Login

The camera has a web admin panel. Use hydra with a default credential list to break in.

hydra -l admin -P creds.txt 192.168.1.110 http-get /
4

Pull the RTSP Stream

Use the cracked credentials to access the live video feed.

ffplay rtsp://admin:[email protected]:554/stream1
Defense

Securing Your Cameras

Make sure YOUR cameras aren't the ones showing up on Shodan.

Camera Hardening Checklist

  • Change default credentials immediately. Strong unique password per camera.
  • Never port-forward camera ports. No inbound 80/554/8080 from the internet. Use a VPN for remote viewing instead.
  • Disable UPnP on the camera and router — it silently punches holes in your firewall.
  • Update firmware — Hikvision, Dahua, and others have had critical auth-bypass CVEs patched.
  • Isolate cameras on their own VLAN with no internet access and no route to your main LAN.
  • Require authentication on RTSP and disable anonymous streaming.
  • Check Shodan for your own IP regularly to see what the internet sees.

Room Complete

You found the camera, brute-forced the web login with default creds, and pulled the live RTSP feed — the same technique behind every "hacked camera" scandal you've read about.

Next: Take the IoT Hacking room or return to the network map.