How to brute force a login page of an IP camera created in .asp?

Question

I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the brute force, however I have not been successful in completing this, I know the method I am using is not the correct one, I think, I don't know :(

All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp , and I do not see any <form> in the source code of the login.asp page. The login url created when you visit http://192.168.1.3:85 is

http://192.168.1.3:85/doc/page/login.asp?_1503752871126

(GET method is used, checked via Wireshark, HTTP requests to /PSIA/Custom/SelfExt/userCheck)

I need your help with the below:

1. Can I use brute force using hydra for .asp ?
2. If yes how does the command look like ? I used

hydra -l admin -P wordlist.txt 192.168.1.3 -s 85 http-form-get '/PSIA/Custom/SelfExt/userCheck:lausername=^USER^&lapassword=^PASS^:User name or password is incorrect:H=Authorization: Basic YWRtaW46QkM1MUZFOTUyRkI3' -V

3. If not how can I get access to this IP camera like a cracker?

Other Information nmap: OPEN PORTS:

• 23 - telnet BusyBox telnetd,
• 85 - http Hikvision IP camera httpd,
• 443 - ssl/http Hikvision IP camera httpd,
• 554 - rtsp Hikvision 7513 POE IP camera rtspd,
• 7001 - afs3-callback?,8000 - http-alt?,
• 8200 - trivnet1?

kindly advise.

Answer 1

"All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp"

extension of .php vs .asp should not matter.

I do not see any <form> in the source code of the login.asp page.

how did you come up with the URL /PSIA/Custom/SelfExt.... etc?

hydra -l admin -P wordlist.txt 192.168.1.3 -s 85 http-form-get '/PSIA/Custom/SelfExt/userCheck:lausername=^USER^&lapassword=^PASS^:User name or password is incorrect:H=Authorization: Basic YWRtaW46QkM1MUZFOTUyRkI3' -V

You appear to be using a mix of Forms based authentication and Basic Authentication with this command. Also, you have expectations for two variables to be filled in with ^USER^ and ^PASS^ and are only supplying one variable as the file wordlist.txt just has one field. How did you determine that this login is using Basic AUTH? Does the basic auth pop up when you try to log in from login.asp?