I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the brute force, however I have not been successful in completing this, I know the method I am using is not the correct one, I think, I don't know :(
All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp , and I do not see any <form>
in the source code of the login.asp page. The login url created when you visit http://192.168.1.3:85 is
(GET method is used, checked via Wireshark, HTTP requests to /PSIA/Custom/SelfExt/userCheck)
I need your help with the below:
- Can I use brute force using hydra for .asp ?
- If yes how does the command look like ? I used
hydra -l admin -P wordlist.txt 192.168.1.3 -s 85 http-form-get '/PSIA/Custom/SelfExt/userCheck:lausername=^USER^&lapassword=^PASS^:User name or password is incorrect:H=Authorization: Basic YWRtaW46QkM1MUZFOTUyRkI3' -V
- If not how can I get access to this IP camera like a cracker?
Other Information nmap: OPEN PORTS:
- 23 - telnet BusyBox telnetd,
- 85 - http Hikvision IP camera httpd,
- 443 - ssl/http Hikvision IP camera httpd,
- 554 - rtsp Hikvision 7513 POE IP camera rtspd,
- 7001 - afs3-callback?,8000 - http-alt?,
- 8200 - trivnet1?
kindly advise.