针对CCTV摄像头的扫描爆破工具 ：Cameradar

[root@localhost docker_test]# uname -a
Linux bogon 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost docker_test]#

[root@localhost docker_test]# yum update
Loaded plugins: fastestmirror, langpacks
Determining fastest mirrors
* base: mirrors.huaweicloud.com
* extras: mirrors.tuna.tsinghua.edu.cn
* updates: mirrors.huaweicloud.com
base                                                     | 3.6 kB     00:00     
extras                                                   | 2.9 kB     00:00     
updates                                                  | 2.9 kB     00:00     
(1/4): base/7/x86_64/group_gz                              | 165 kB   00:00     
(2/4): extras/7/x86_64/primary_db                          | 153 kB   00:00     
(3/4): updates/7/x86_64/primary_db                         | 2.8 MB   00:01     
(4/4): base/7/x86_64/primary_db                            | 6.0 MB   00:02

[root@localhost docker_test]# yum install -y yum-utils device-mapper-persistent-data lvm2
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirrors.huaweicloud.com
* extras: mirrors.tuna.tsinghua.edu.cn
* updates: mirrors.huaweicloud.com
Package yum-utils-1.1.31-52.el7.noarch already installed and latest version
Package device-mapper-persistent-data-0.8.5-1.el7.x86_64 already installed and latest version
Package 7:lvm2-2.02.185-2.el7_7.2.x86_64 already installed and latest version
Nothing to do

[root@localhost yum.repos.d]# docker pull ullaakut/cameradar
Using default tag: latest
latest: Pulling from ullaakut/cameradar
9d48c3bd43c5: Pull complete
cc7766bf8751: Pull complete
a497a345880d: Pull complete
919b21ac9ea0: Pull complete
3f9aebbc778b: Pull complete
Digest: sha256:04bbc19c486584ccc12d8bca2bd07e24bb859b63c44e07c0c17e940ec8badc75
Status: Downloaded newer image for ullaakut/cameradar:latest

[root@localhost yum.repos.d]# docker images
REPOSITORY           TAG                 IMAGE ID            CREATED             SIZE
ullaakut/cameradar   latest              fe268aaf499c        5 weeks ago         68.8MB
hello-world          latest              fce289e99eb9        10 months ago       1.84kB
[root@localhost yum.repos.d]#

用法：
docker run -t -v /my/folder/withhttps://img.qb5200.com/download-x/dictionaries:/tmphttps://img.qb5200.com/download-x/dictionaries \
           ullaakut/cameradar \
           -r "/tmphttps://img.qb5200.com/download-x/dictionaries/my_routes" \
           -c "/tmphttps://img.qb5200.com/download-x/dictionaries/my_credentials.json" \
           -t 172.19.124.0/24

[root@localhost ~]# docker run  ullaakut/cameradar -t192.168.64.128
Loading credentials...ok
  > Loading credentials dictionary from path "/apphttps://img.qb5200.com/download-x/dictionaries/credentials.json"
  > Loaded 14 usernames and 32 passwords
Loading routes...ok
  > Loading routes dictionary from path "/apphttps://img.qb5200.com/download-x/dictionaries/routes"
  > Loaded 182 routes
Scanning the network...ok
  > Found 0 RTSP streams
✖ unable to attack empty list of targets

[root@localhost cameradar]# ls
attack.go       cmd           Dockerfile  helpers.go         LICENSE          README.md        scan_test.go
attack_test.go  curl.go       examples    helpers_test.go    loaders.go       scan.go          summary.go
cameradar.go    curl_test.go  go.mod      images             loaders_test.go  scanner.go       summary_test.go
CHANGELOG.md    dictionaries  go.sum      ISSUE_TEMPLATE.md  models.go        scanner_test.go  tools
[root@localhost cameradar]# cd dictionaries/
[root@localhost dictionaries]# ls
credentials.json  routes
[root@localhost dictionaries]# head credentials.json
{
  "usernames": [
    "",
    "666666",
    "888888",
    "Admin",
    "admin",
    "admin1",
    "administrator",
    "Administrator",
[root@localhost dictionaries]# head routes


/live/ch01_0
0/1:1/main
0/usrnm:pwd/main
0/video1
1
1.AMP
1/h264major
1/stream1
11

[root@localhost tools]# ls
my_credentials.json  my_routes
[root@localhost tools]# vim my_credentials.json
{
  "usernames": [
    "",
    "666666",
    "888888",
    "Admin",
    "admin",
    "admin1",
    "administrator",
    "Administrator",
    "aiphone",
    "Dinion",
    "root",
    "service",
    "supervisor",
    "ubnt",
    "test",
    "ciby",
    "hello"
  ],
  "passwords": [
    "",
    "111111",
    "1111111",
    "1234",
    "12345",
    "123456",
    "12345678",
    "4321",
    "666666",
    "888888",
    "9999",
    "admin",
    "administrator",
    "aiphone",
    "camera",
    "fliradmin",
    "hikvision",
    "hikadmin",
    "ikwd",
    "jvc",
    "meinsm",
    "pass",
    "password",
    "reolink",
    "root",
    "service",
    "supervisor",
    "system",
    "toor",
    "tp-link",
    "ubnt",
    "wbox123",
    "test.com",
    "test1.com",
    "123.com"
  ]
}
[root@localhost tools]# head my_routes

/live/ch01_0
0/1:1/main
0/usrnm:pwd/main
0/video1
1
1.AMP
1/h264major
1/stream1
11

[root@localhost tools]# docker run -t -v /homehttps://img.qb5200.com/download-x/docker_test/tools:/tmp ullaakut/cameradar -c "/tmp/my_credentials.json" -r "/tmp/my_routes" -t 192.168.64.128
Loading credentials...ok
  > Loading credentials dictionary from path "/tmp/my_credentials.json"
  > Loaded 17 usernames and 35 passwords
Loading routes...ok
  > Loading routes dictionary from path "/tmp/my_routes"
  > Loaded 182 routes
Scanning the network...ok
  > Found 0 RTSP streams
✖ unable to attack empty list of targets

[root@localhost tools]# docker run -t -v /homehttps://img.qb5200.com/download-x/docker_test/tools:/tmp ullaakut/cameradar -c "/tmp/my_credentials.json" -r "/tmp/my_routes" -t "/homehttps://img.qb5200.com/download-x/docker_test/tools/target.txt"
Loading credentials...ok
  > Loading credentials dictionary from path "/tmp/my_credentials.json"
  > Loaded 17 usernames and 35 passwords
Loading routes...ok
  > Loading routes dictionary from path "/tmp/my_routes"
  > Loaded 182 routes
Scanning the network...ko
✖ error while scanning network: Unable to split netmask from target expression: "/homehttps://img.qb5200.com/download-x/docker_test/tools/target.txt"
WARNING: No targets were specified, so 0 hosts scanned

[root@localhost tools]# docker run -t -v /homehttps://img.qb5200.com/download-x/docker_test/tools:/tmp ullaakut/cameradar -c "/tmp/my_credentials.json" -r "/tmp/my_routes" -t 192.168.64.0/24
Loading credentials...ok
  > Loading credentials dictionary from path "/tmp/my_credentials.json"
  > Loaded 17 usernames and 35 passwords
Loading routes...ok
  > Loading routes dictionary from path "/tmp/my_routes"
  > Loaded 182 routes
Scanning the network...

* “ -h”：显示用法信息
* “ -T，--2000ms timeout ”：（默认：）设置自定义超时值，在此之后应放弃没有答案的攻击尝试。在尝试扫描不稳定和慢速的网络时，建议增加该值；在快速可靠的网络中，建议减少该值。
* “ -d，-- debug ”：启用调试日志
* “ -v，-- verbose ”：启用详细的curl日志（不推荐用于大多数用途）
“ -s，--scan-speed”：（默认：）4设置自定义nmap发现预设以提高速度或准确性。如果您尝试扫描不稳定和慢速的网络，建议降低它，如果在性能良好且可靠的网络上，则建议增加它。您可能还希望将其保持在较低水平，以使发现变得隐秘。