Hacktricks-skills rtsp-pentesting

How to enumerate and test RTSP (Real Time Streaming Protocol) services on ports 554/8554. Use this skill whenever you need to assess RTSP cameras, streaming servers, or media services, check for authentication vulnerabilities, enumerate RTSP endpoints, or access video streams. Trigger this for any RTSP-related security testing, camera pentesting, or streaming service assessment, even if the user doesn't explicitly mention RTSP but describes testing IP cameras, surveillance systems, or video streaming services.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/network-services-pentesting/554-8554-pentesting-rtsp/SKILL.MD

source content

RTSP Pentesting

A skill for testing Real Time Streaming Protocol (RTSP) services, commonly used by IP cameras and streaming media servers.

What is RTSP?

RTSP is a network control protocol for controlling streaming media servers. It uses VHS-style commands (play, record, pause) to control media sessions. The actual media transmission typically uses RTP/RTCP, though some vendors use proprietary protocols.

Default ports: 554/tcp, 8554/tcp

Quick Start

If you have a target IP and want to test RTSP immediately:

# Quick enumeration
nmap -sV --script "rtsp-*" -p 554,8554 <TARGET_IP>

# Test with our script
python scripts/test-rtsp-auth.py <TARGET_IP> 554

Enumeration

Nmap Scripts

Use Nmap's RTSP-specific scripts to enumerate services:

# Basic RTSP enumeration
nmap -sV --script "rtsp-*" -p 554,8554 <TARGET_IP>

# More detailed with version detection
nmap -sV -p 554,8554 <TARGET_IP>

Manual RTSP Requests

RTSP is similar to HTTP. Send a DESCRIBE request to check access:

# Unauthenticated test
echo -e "DESCRIBE rtsp://<IP>:<PORT>/ RTSP/1.0\r\nCSeq: 1\r\n\r\n" | nc <IP> <PORT>

Response codes:

```
200 OK
```
- Unauthenticated access granted
```
401 Unauthorized
```
- Authentication required (check for Basic or Digest)

Authentication Testing

Basic Authentication

For Basic auth, encode credentials in base64:

# Example: admin:1234
# Base64: YWRtaW46MTIzNA==

echo -e "DESCRIBE rtsp://<IP>:<PORT>/ RTSP/1.0\r\nCSeq: 1\r\nAuthorization: Basic YWRtaW46MTIzNA==\r\n\r\n" | nc <IP> <PORT>

Using the Test Script

The bundled

test-rtsp-auth.py

script automates authentication testing:

# Test unauthenticated access
python scripts/test-rtsp-auth.py <IP> <PORT>

# Test with credentials
python scripts/test-rtsp-auth.py <IP> <PORT> -u admin -p password

# Test with wordlist
python scripts/test-rtsp-auth.py <IP> <PORT> -w /path/to/wordlist.txt

Viewing RTSP Streams

Once you have a valid path and credentials, use ffplay to view the stream:

# Basic stream viewing
ffplay -rtsp_transport tcp rtsp://<IP>:<PORT>/<PATH>

# With resolution control
ffplay -rtsp_transport tcp rtsp://<IP>:<PORT>/mpeg4 -x 2560 -y 1440

# Common RTSP paths to try:
# /, /live.sdp, /mpeg4, /stream1, /video, /cam1, /axis-media/media.amp

Key flags:

```
-rtsp_transport tcp
```
- Use TCP for more reliable streaming (recommended)
```
-x
```
,
```
-y
```
- Control video resolution

Brute Force Tools

Cameradar

Cameradar is a comprehensive RTSP testing tool:

Detects open RTSP hosts
Gets public info (hostname, port, camera model)
Automated dictionary attacks for stream routes
Automated dictionary attacks for credentials
Generates thumbnails for quick preview
Validates streams with Gstreamer

# Install
pip install cameradar

# Basic scan
cameradar <IP>

# With wordlists
cameradar <IP> -u users.txt -p passwords.txt

RTSP AuthGrinder

RTSP AuthGrinder for brute forcing:

# Usage
python rtsp_authgrinder.py -t <IP> -p <PORT> -u <users_file> -w <passwords_file>

Common RTSP Paths

Try these common stream paths:

/
/live.sdp
/mpeg4
/stream1
/video
/cam1
/axis-media/media.amp
/h264
/mjpeg
/stream
/ch00_0.h264

Common Default Credentials

Test these common defaults:

admin:admin
admin:password
admin:1234
admin:12345
admin:123456
root:root
root:password
user:user
admin:(blank)
:(blank)

Workflow Summary

Enumerate - Use nmap to find RTSP services
Test access - Try unauthenticated DESCRIBE request
Check auth type - If 401, determine Basic vs Digest
Brute force - Use cameradar or authgrinder with wordlists
Access stream - Use ffplay with discovered credentials
Document - Save stream URLs and credentials found

Security Considerations

Only test systems you have authorization to assess
RTSP cameras often expose sensitive video feeds
Document all findings for remediation
Consider the privacy implications of accessing video streams