Convert Figma logo to code with AI

Ullaakut logocameradar

Cameradar hacks its way into RTSP videosurveillance cameras

5,019
621
5,019
15
View on GitHub

Top Related Projects

Ullaakut's avatar

cameradar

5,019

Cameradar hacks its way into RTSP videosurveillance cameras

woj-ciech's avatar

kamerka

1,267

Build interactive map of cameras from Shodan

Manisso's avatar

fsociety

12,030

fsociety Hacking Tools Pack – A Penetration Testing Framework

Quick Overview

Cameradar is an open-source tool designed to detect and access RTSP streams from surveillance cameras. It automates the process of discovering IP cameras on a network, testing for default credentials, and providing access to the video streams. Cameradar is particularly useful for security researchers and network administrators.

Pros

  • Efficient network scanning and camera discovery
  • Automated credential testing against common defaults
  • Provides direct access to discovered camera streams
  • Customizable and extensible for specific use cases

Cons

  • Potential for misuse in unauthorized access attempts
  • May trigger security alerts on monitored networks
  • Limited to RTSP protocol cameras
  • Requires careful use to avoid legal issues

Code Examples

  1. Basic usage to scan a network:
package main

import "github.com/Ullaakut/cameradar"

func main() {
    streams, err := cameradar.Scan(cameradar.Options{
        Targets: []string{"192.168.1.0/24"},
    })
    if err != nil {
        panic(err)
    }
    for _, stream := range streams {
        println(stream.URL)
    }
}
  1. Custom dictionary attack:
package main

import "github.com/Ullaakut/cameradar"

func main() {
    streams, err := cameradar.Scan(cameradar.Options{
        Targets:  []string{"192.168.1.0/24"},
        Usernames: []string{"admin", "root"},
        Passwords: []string{"password", "12345"},
    })
    if err != nil {
        panic(err)
    }
    // Process discovered streams
}
  1. Using custom ports:
package main

import "github.com/Ullaakut/cameradar"

func main() {
    streams, err := cameradar.Scan(cameradar.Options{
        Targets: []string{"192.168.1.0/24"},
        Ports:   []string{"554", "8554"},
    })
    if err != nil {
        panic(err)
    }
    // Process discovered streams
}

Getting Started

To use Cameradar in your Go project:

  1. Install the library:

    go get -u github.com/Ullaakut/cameradar

  2. Import it in your code:

    import "github.com/Ullaakut/cameradar"

  3. Use the Scan function with appropriate options:

    streams, err := cameradar.Scan(cameradar.Options{
    Targets: []string{"192.168.1.0/24"},
})
if err != nil {
    // Handle error
}
// Process discovered streams

Remember to use this tool responsibly and only on networks you have permission to scan.

Competitor Comparisons

Ullaakut logo

cameradar

5,019

Cameradar hacks its way into RTSP videosurveillance cameras

Pros of Cameradar

  • Well-maintained and actively developed project
  • Comprehensive documentation and usage instructions
  • Supports multiple protocols and attack vectors

Cons of Cameradar

  • May require more setup and configuration
  • Potentially higher resource usage due to advanced features
  • Steeper learning curve for new users

Code Comparison

Cameradar:

func main() {
    options := &cameradar.Options{
        Targets:     []string{"192.168.1.0/24"},
        Ports:       []string{"554", "8554"},
        Speed:       4,
        Timeout:     2000,
        EnableLogs:  true,
    }
    streams, err := cameradar.Discover(options)
}

Since both repositories are the same project (Ullaakut/cameradar), there is no code comparison to be made. The code snippet above represents a typical usage of the Cameradar tool.

Summary

Cameradar is a robust tool for discovering and accessing RTSP streams from surveillance cameras. It offers a wide range of features and customization options, making it suitable for both basic and advanced users. While it may require more setup and have a steeper learning curve, its active development and comprehensive documentation make it a valuable resource for network security professionals and researchers.

woj-ciech logo

kamerka

1,267

Build interactive map of cameras from Shodan

Pros of Kamerka

  • Provides a more comprehensive approach to camera discovery, including geolocation and additional IoT device detection
  • Offers a web interface for easier visualization and interaction with discovered devices
  • Integrates with external services like Shodan for enhanced device information gathering

Cons of Kamerka

  • May have a steeper learning curve due to its broader feature set
  • Requires more dependencies and setup compared to Cameradar's simpler approach
  • Potentially slower execution time when performing comprehensive scans

Code Comparison

Kamerka (Python):

def get_shodan_data(ip):
    try:
        results = api.host(ip)
        return results
    except Exception as e:
        print(f"Error: {e}")
        return None

Cameradar (Go):

func (s *Scanner) getSupportedStreamURIs(streams []string) ([]string, error) {
    var supportedStreams []string
    for _, stream := range streams {
        if s.isStreamSupported(stream) {
            supportedStreams = append(supportedStreams, stream)
        }
    }
    return supportedStreams, nil
}

Both projects aim to discover and analyze network cameras, but Kamerka offers a broader scope with additional features for IoT device detection and geolocation. Cameradar focuses specifically on RTSP camera discovery and access, providing a more streamlined approach. The code snippets demonstrate the different languages used (Python for Kamerka, Go for Cameradar) and highlight their distinct approaches to data gathering and processing.

Manisso logo

fsociety

12,030

fsociety Hacking Tools Pack – A Penetration Testing Framework

Pros of fsociety

  • Broader scope of tools and functionalities for various penetration testing tasks
  • Includes a user-friendly menu-driven interface for easier navigation
  • Supports multiple operating systems (Linux, macOS, Windows)

Cons of fsociety

  • Less focused on a specific task, potentially reducing effectiveness in specialized scenarios
  • May require more setup and dependencies due to its comprehensive nature
  • Less actively maintained, with fewer recent updates

Code Comparison

fsociety (menu-driven interface):

def menu():
    print("\nfSociety Main Menu")
    print("1) Information Gathering")
    print("2) Password Attacks")
    print("3) Wireless Testing")
    # ... more options

Cameradar (focused functionality):

func main() {
    options := parseArgs()
    streams := discover(options)
    credentials := attack(streams, options)
    printResults(credentials)
}

The code snippets highlight the different approaches: fsociety offers a menu-driven interface for various tools, while Cameradar focuses on a specific task with a streamlined workflow.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Cameradar

Coverage Status

RTSP stream access tool

Cameradar scans RTSP endpoints on authorized targets, and uses dictionary attacks to bruteforce their credentials and routes.

What Cameradar does

  • Detects open RTSP hosts on accessible targets.
  • Detects the device model that streams the RTSP feed.
  • Attempts dictionary-based discovery of stream routes (for example, /live.sdp).
  • Attempts dictionary-based discovery of camera credentials.
  • Produces a report of findings.

Table of contents

Quick start with Docker

Install Docker and run:

docker run --rm -t --net=host ullaakut/cameradar --targets <target>

Example:

docker run --rm -t --net=host ullaakut/cameradar --targets 192.168.100.0/24

This scans ports 554, 5554, and 8554 on the target subnet. It attempts to enumerate RTSP streams. For all options, see Configuration reference.

  • Targets can be CIDRs, IPs, IP ranges or a hostname.

    • Subnet: 172.16.100.0/24
    • IP: 172.16.100.10
    • Host: localhost
    • Range: 172.16.100.10-20

  • To use custom dictionaries, mount them and pass both flags:

    docker run --rm -t --net=host \
    -v /path/to/dictionaries:/tmp/dictionaries \
    ullaakut/cameradar \
    --custom-routes /tmp/dictionaries/my_routes \
    --custom-credentials /tmp/dictionaries/my_credentials.json \
    --targets 192.168.100.0/24

Install the binary

Use this option if Docker is not available or if you want a local build.

Dependencies

  • Go 1.25 or later

Steps

  1. go install github.com/Ullaakut/cameradar/v6/cmd/cameradar@latest

The cameradar binary is now in your $GOPATH/bin. For available flags, see Configuration reference.

Install on Android (Termux)

These steps summarize a working Termux setup for Android. Use Termux 117 from F-Droid or the official Termux site, not Google Play.

1) Set up Termux and Alpine

Install the required packages in Termux:

pkg update
pkg install mc wget git nmap proot-distro

Install Alpine and log in:

proot-distro install alpine
proot-distro login alpine

2) Install build tools in Alpine

apk add wget git go gcc clang musl-dev make

3) Build Cameradar

Create a module path and clone the repo:

mkdir -p go/pkg/mod/github.com/Ullaakut
cd go/pkg/mod/github.com/Ullaakut
git clone https://github.com/Ullaakut/cameradar.git
cd cameradar/cmd/cameradar
go install

4) Run Cameradar

Copy dictionaries and run the binary:

mkdir -p /tmp
cp -r ../../dictionaries /tmp/dictionaries
/go/bin/cameradar --targets=<target> --custom-credentials=/tmp/dictionaries/credentials.json --custom-routes=/tmp/dictionaries/routes --ui=plain --debug

Replace <target> with an IP, range, host or subnet you are authorized to test.

Configuration

The default RTSP ports are 554, 5554, 8554. If you do not specify ports, Cameradar uses those.

Example of scanning custom ports:

docker run --rm -t --net=host \
    ullaakut/cameradar \
    --ports "18554,19000-19010" \
    --targets localhost

You can replace the default dictionaries with your own routes and credentials files. The repository provides baseline dictionaries in the dictionaries folder.

docker run --rm -t --net=host \
    -v /my/folder/with/dictionaries:/tmp/dictionaries \
    ullaakut/cameradar \
    --custom-routes /tmp/dictionaries/my_routes \
    --custom-credentials /tmp/dictionaries/my_credentials.json \
    --targets 172.19.124.0/24

Skip discovery with --skip-scan

If you already know the RTSP endpoints, you can skip discovery and treat each target and port as a stream candidate. This mode does not run discovery and can be useful on restricted networks or when you want to attack a known inventory.

Skipping discovery means:

  • Cameradar does not run discovery and does not detect device models.
  • Targets resolve to IP addresses. Hostnames resolve via DNS.
  • CIDR blocks and IPv4 ranges expand to every address in the range.
  • Large ranges create many targets, so use them carefully.

Example:

docker run --rm -t --net=host \
    ullaakut/cameradar \
    --skip-scan \
    --ports "554,8554" \
    --targets 192.168.1.10

In this example, Cameradar attempts dictionary attacks against ports 554 and 8554 of 192.168.1.10.

Choose the discovery scanner with --scanner

Cameradar supports two discovery backends:

  • nmap (default)
  • masscan

Use nmap when you want more reliable RTSP discovery: it performs service identification and can better distinguish RTSP from other open ports.

Use masscan when scanning very large networks: it is generally faster and more efficient at scale, but it does not provide service discovery.

docker run --rm -t --net=host \
    ullaakut/cameradar \
    --scanner masscan \
    --ports "554,8554" \
    --targets 192.168.1.0/24

[!WARNING]
--scan-speed only applies to the nmap scanner.

Security and responsible use

Cameradar is a penetration testing tool. Only scan networks and devices you own or have explicit permission to test. Do not use this tool to access unauthorized systems or streams. If you are unsure, stop and get written approval before scanning.

Output

Cameradar presents results in a readable terminal UI. It logs findings to the console. The report includes discovered hosts, identified device models, and valid routes or credentials. If you specify a path for the --output flag, Cameradar also writes an M3U playlist with the discovered streams.

Check camera access

Use VLC Media Player to connect to a stream:

rtsp://username:password@address:port/route

Input file format

The file can contain IPs, hostnames, IP ranges, and subnets. Separate entries with newlines. Example:

0.0.0.0
localhost
192.17.0.0/16
192.168.1.140-255
192.168.2-3.0-255

When you use --skip-scan, Cameradar expands each entry into explicit IP addresses before building the target list.

Command-line options and environment variables

The complete CLI and environment variable reference is maintained in Configuration reference.

This includes all supported flags, defaults, accepted values, and env var mapping.

Build and contribute

Docker build

Run the following command in the repository root:

docker build . -t cameradar

The resulting image is named cameradar.

Go build

  1. go install github.com/Ullaakut/cameradar/v6/cmd/cameradar@latest

The cameradar binary is now in $GOPATH/bin/cameradar.

Frequently asked questions

See Troubleshooting & FAQ

Examples

Running cameradar on your own machine to scan for default ports

docker run --rm -t --net=host ullaakut/cameradar --targets localhost

Running cameradar with an input file, logs enabled on port 8554

docker run --rm -t --net=host -v /tmp:/tmp ullaakut/cameradar --targets /tmp/test.txt --ports 8554

Running cameradar on a subnetwork with custom dictionaries, on ports 554, 5554 and 8554

docker run --rm -t --net=host -v /tmp:/tmp ullaakut/cameradar --targets 192.168.0.0/24 --custom-credentials "/tmp/dictionaries/credentials.json" --custom-routes "/tmp/dictionaries/routes" --ports 554,5554,8554

Running cameradar with masscan discovery

docker run --rm -t --net=host ullaakut/cameradar --scanner masscan --targets 192.168.0.0/24 --ports 554,8554

License

Copyright 2026 Ullaakut

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.