| name | rtsp-pentesting |
| description | How to enumerate and test RTSP (Real Time Streaming Protocol) services on ports 554/8554. Use this skill whenever you need to assess RTSP cameras, streaming servers, or media services, check for authentication vulnerabilities, enumerate RTSP endpoints, or access video streams. Trigger this for any RTSP-related security testing, camera pentesting, or streaming service assessment, even if the user doesn't explicitly mention RTSP but describes testing IP cameras, surveillance systems, or video streaming services. |
RTSP Pentesting
A skill for testing Real Time Streaming Protocol (RTSP) services, commonly used by IP cameras and streaming media servers.
What is RTSP?
RTSP is a network control protocol for controlling streaming media servers. It uses VHS-style commands (play, record, pause) to control media sessions. The actual media transmission typically uses RTP/RTCP, though some vendors use proprietary protocols.
Default ports: 554/tcp, 8554/tcp
Quick Start
If you have a target IP and want to test RTSP immediately:
nmap -sV --script "rtsp-*" -p 554,8554 <TARGET_IP>
python scripts/test-rtsp-auth.py <TARGET_IP> 554
Enumeration
Nmap Scripts
Use Nmap's RTSP-specific scripts to enumerate services:
nmap -sV --script "rtsp-*" -p 554,8554 <TARGET_IP>
nmap -sV -p 554,8554 <TARGET_IP>
Manual RTSP Requests
RTSP is similar to HTTP. Send a DESCRIBE request to check access:
echo -e "DESCRIBE rtsp://<IP>:<PORT>/ RTSP/1.0\r\nCSeq: 1\r\n\r\n" | nc <IP> <PORT>
Response codes:
200 OK - Unauthenticated access granted401 Unauthorized - Authentication required (check for Basic or Digest)
Authentication Testing
Basic Authentication
For Basic auth, encode credentials in base64:
echo -e "DESCRIBE rtsp://<IP>:<PORT>/ RTSP/1.0\r\nCSeq: 1\r\nAuthorization: Basic YWRtaW46MTIzNA==\r\n\r\n" | nc <IP> <PORT>
Using the Test Script
The bundled test-rtsp-auth.py script automates authentication testing:
python scripts/test-rtsp-auth.py <IP> <PORT>
python scripts/test-rtsp-auth.py <IP> <PORT> -u admin -p password
python scripts/test-rtsp-auth.py <IP> <PORT> -w /path/to/wordlist.txt
Viewing RTSP Streams
Once you have a valid path and credentials, use ffplay to view the stream:
ffplay -rtsp_transport tcp rtsp://<IP>:<PORT>/<PATH>
ffplay -rtsp_transport tcp rtsp://<IP>:<PORT>/mpeg4 -x 2560 -y 1440
Key flags:
-rtsp_transport tcp - Use TCP for more reliable streaming (recommended)-x, -y - Control video resolution
Brute Force Tools
Cameradar
Cameradar is a comprehensive RTSP testing tool:
- Detects open RTSP hosts
- Gets public info (hostname, port, camera model)
- Automated dictionary attacks for stream routes
- Automated dictionary attacks for credentials
- Generates thumbnails for quick preview
- Validates streams with Gstreamer
pip install cameradar
cameradar <IP>
cameradar <IP> -u users.txt -p passwords.txt
RTSP AuthGrinder
RTSP AuthGrinder for brute forcing:
python rtsp_authgrinder.py -t <IP> -p <PORT> -u <users_file> -w <passwords_file>
Common RTSP Paths
Try these common stream paths:
/
/live.sdp
/mpeg4
/stream1
/video
/cam1
/axis-media/media.amp
/h264
/mjpeg
/stream
/ch00_0.h264
Common Default Credentials
Test these common defaults:
admin:admin
admin:password
admin:1234
admin:12345
admin:123456
root:root
root:password
user:user
admin:(blank)
:(blank)
Workflow Summary
- Enumerate - Use nmap to find RTSP services
- Test access - Try unauthenticated DESCRIBE request
- Check auth type - If 401, determine Basic vs Digest
- Brute force - Use cameradar or authgrinder with wordlists
- Access stream - Use ffplay with discovered credentials
- Document - Save stream URLs and credentials found
Security Considerations
- Only test systems you have authorization to assess
- RTSP cameras often expose sensitive video feeds
- Document all findings for remediation
- Consider the privacy implications of accessing video streams
References
