How To Write An RTSP URL Honeypot...

Here's a few lines of code you can use to capture the URL's that various discovery tools use when trying to figure out what camera(s) are on the network. This can be helpful when troubleshooting, or when trying to figure out a cameras RTSP URL.

Also, if one is writing client software, this can give you a headstart on URLS that other programs are already using.

This assumes you have a linux box or virtual machine, but there are versions of netcat available for windows, so its easily adapted.

create a file called url.sh:

#!/bin/sh
read url
echo $url >> urls
echo RTSP/1.0 404 Not Found

Then run netcat like so:

nc -ll -p 554 -e url.sh

Then just tell your discovery tool that a camera exists at that IP and let it go to work. After a few minutes, kill it and get the honey in the urls file.

Here's what I got using AnyCam's discovery process:

OPTIONS rtsp://192.168.200.1:554 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554//Streaming/Channels/1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554//Streaming/Channels/2 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/cam/realmonitor?channel=1&subtype=1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/h264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/cam1/h264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/video.h264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live.sdp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/mpeg4 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/play1.sdp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/HighResolutionVideo RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/image.mpg RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/rtsph2641080p RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/h264/ch1/sub/ RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/mpeg4unicast RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/onvif/profile1/media.smp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/MediaInput/h264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/profile1/media.smp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/h264unicast RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/H264/media.smp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/mpeg4/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/axis-media/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/onvif-media/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/axis-media/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/mpeg4 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/mpeg4/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/axis-media/media.amp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live1.sdp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/PSIA/Streaming/channels/1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/ch01.264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/1/stream1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/ucast/11 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/stream.sdp1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live1.264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live0.264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/?channel=1&stream=0.sdp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/av0_0 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/av0_1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live/h264 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live/ch00_0 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/video RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/rtsp_tunnel RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/cgi-bin/rtspStream/1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live3.sdp RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/11 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/12 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/VideoInput/1/h264/1 RTSP/1.0
OPTIONS rtsp://192.168.200.1:554/live.sdp RTSP/1.0

Next up, Milestone?

Login to read this IPVM discussion.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

**** ****!

***, *** *** *** ************? ******** ************ **** ** ********* ***** ****?

* *** ****** **** ******* ** ********. ** ****** ****** confident **** ** ***** ****** *** ***, *** **** ** couldn't, * *** *** ***** ******* ********* ******* *** ****** thing.

**** * ******** **** *** ***** ***** ***** ********* **** giving *** ***** ****** *** ******** **** ** ****** ****.

****, ******** *** * "********" ** *** **** ** ******** sense ** *** ****.

*** *** *** **** ** **** ******** ** ***, *** wait...

**** ***** **** ***********, *** *** ************* *** **** *** bolts ** **. *** *** ***** **** **** ** **** simple ******'* *****?

***** *** ******/****** ***** ***** **** *** ** **** *******? In * **** ***** ***********, **** ***** **** **** ** handy?

******, *****'* ***** ** ** ** ******* **** *** **** IP *******, **** *** **** ***? *** **** *** ******** streams **** **** ***?

"******, *****'* ***** ** ** ** ******* **** *** **** IP *******, **** *** **** ***?"

* ** ******** ***** *** ********* ******** **** ** *** IP *******, ****** ** *** ** *** ********. ***** ***** connectivity ********. *, **** ** *** ***?

* ** ******** ***** *** ********* ******** **** ** *** IP *******, ****** ** *** ** *** ********. ***** ***** connectivity ********.

****'* *******. ****** ** ****** ****** ** *** ***** ****, as ** ***** ** **** ** ** *** ****.

***, * **** *** **** ** ********, (***** *****), ** opening ** ** ******** *****. ***** ******* **** * ** 3 ***** ******. *************, **** ******** ***** *** ****** * manufacturer ***** *** ***** ***** *** ******* ***** ** ********* depending ** ******* *** ****** ***** ** ***, *** **** are ***. **** *** **** ** ********* ******, ********** **** are ** *** ***** ** **** ****** ** *****.

***** *** ******/****** ***** ***** **** *** ** **** *******? In * **** ***** ***********, **** ***** **** **** ** handy?

*** **** ******, ** ******'* **** ** *****. *** ******* developing ****** ************ ******** ****** ** ***** ****** **** *** a *********. ******** *** *********** ** ******* **** ******* *** various ****** *********, *** **** *** ******* ***** **** *****.

******* ** ** ***** **** ** ***** **** **** ********* has ******* ***** *** *****? *** **** *********** ****** **** database **** *** ****** ********* ** ******?

******, *****'* ***** ** ** ** ******* **** *** **** IP *******, **** *** **** ***?

*** ** ** *** *** **** *** ******** ******, ***** is **** *** ****** ******* ** *** ** ********* ** port ***.

*** **** *** ******** ******* **** **** ***?

*** *** *** ******** ****************** ******. **** ***** ****** ****** ******* ******* *** ****** we **** ***** ** *** **** * ****** ** **** a **. ******* ** ******* ***** ******* ** ****** "* don't **** * ****** ***** *.", ***** ****** ****** ** exhaust *** ** *** ***** **** ** ** ******* ** find *** **** *****.

** * **** *** *** ************ ******** *** * ***** little *****, *** **** ** *** ** **. ******* ********* or * ******* ** * **** ******** **** *********** **** give ***. *** ** ******* **** ** ***** ****** ********* are ******* ( ********** *** ***** ****). ** *** **** streams *** ** * *** ******** ***** **** * *****/***** then ** ***** ** **** **** ****** ** * *** to ** **** *** ****.

**** *** ****** **** * "********" *** ** **** * list ** ******* **** *** ******* ** * ****. *** would **** ** ***** **** **** ****** **** **** **** camera. *** **** ****** **** **** **** * ******** ********* of **** **** *** ** ** ** **** ******.

******* ********* ... ***'* **** ***.

********.

********* ***** ***** *******.

*** ***** **** ** ** ***** ***** * '******', ** listen ** ***.

*** **** **** *** ****** **** *********** ****** ** **** 554, *** **** ****** ******* **** * ***, **** **** discoverer ******* ****** ** *** ******* *** *** ***** *** stop *********.

**** ****** *** *** ***** ********* ******* ** **** *** only *** ******** **** **** *** ***** * **** **-******** report ** **** *** ***** *** ****.

**** ** *** **** **** *****.

******* *********** ... ***'* **** ***.

********.

* **** ***********, ***'* *** ** *****. *** ** ** an ******** **** ** *********** *** ******* **** **** ******* errors. ***, *** **** ***** ******* ** *********** ** *** ordering ** **** ****** ** ***** ******, ** *'* **** your ******** ****. * **** ******* ********** ***** *** ****, and **** ** *** *** ***'* **** ****** ** *****. Which ** *** *** ****** ** **** **** *********** ** unknown ******* ** *********.

** ********, ***'* *** ***** **** ********* ****** *** ****** URL **** **** ***********, ***** *** *** ************?

*** ******'* *** **** * ******, ***-*********** **** ** ****, by ************ **** ********* ****?

* **** ****** ******* ** ** * ****** ******* ** demonstrate *** ******* ****.

*** *** **** ***** ** *** ****** ** **** ********** some ** *** ****** ********* ****** *** **** **** **** try ***** ** *** *** ** *** ******.

** *** ** ******* ** ***** ********* ***** *** *** out **** *********. ** **** ***** * **** ** ***'* to * ******.

"**** ** *** ****** ********* ****** *** **** **** **** try ***** ** *** *** ** *** ******."

** ****** ** ******* ** **** ****....

*** **** ******, ** ******'* **** ** *****. *** ******* developing ****** ************ ******** ****** ** ***** ****** **** *** a *********. ******** *** *********** ** ******* **** ******* *** various ****** *********, *** **** *** ******* ***** **** *****.

**** ****** *** *** ***** ********* ******* ** **** *** only *** ******** **** **** *** ***** * **** **-******** report ** **** *** ***** *** ****.

**** ** *** **** **** *****.

** * *** ** **** ***** *** ******* *** ** use ********* ***** **** **** *** * ********** **** ****** in * *** ***** ******* **** **** **** ** **** a ******** ***** * **** *** * ******** ******** ** a ******** ******** ***** *** *** **** ****(******** *** ********) has **** ****. **** **** *** **** **** ** * low ***** ********* ** * ******** **** ***** *** ***** have *** ** **** ***** **** *** *** **** ** and *** ** ***** ** **** **** *** *** ******* for. * ** ****** ** ***** **** **** ***** ** mins ** ****** ** **** **** ******* ** ****** *** a **** *** ****** ***** ******* ** **** ****** ****** is ********* ***. *** *** ******** *** * "****" **** prefer ** ** *** **** **** *** *** ** ******* than ********* ***** ****.

******* *********** ... ***'* **** ***.

********.

* **** ***********, ***'* *** ** *****. *** ** ** an ******** **** ** *********** *** ******* **** **** ******* errors. ***, *** **** ***** ******* ** *********** ** *** ordering ** **** ****** ** ***** ******, ** *'* **** your ******** ****. * **** ******* ********** ***** *** ****, and **** ** *** *** ***'* **** ****** ** *****. Which ** *** *** ****** ** **** **** *********** ** unknown ******* ** *********.

* ** ***** ** ****** *** ***** ********** ** * didnt ******* **** ****** **** * ***** ** * ******* instead ** ****** **** * **** *** ** *******. * SQLdump ** * **** ** *** *** ******** ** * machine. *********, ***********, *****, *****,*** *** *** * *** ******* to ***** ***** **** ********* **** **** **** *** **** URL's. ** *** **** ** **** ***** *** ****** ***** into ******* ******** *** ***** **** *** **** **** *** be **** ** ******, **** * ***'* ********, *** **** data *** ********** ** *** ******* *** **** ******** **** anything * *** ******* **** ** * **** **** *** would **** ***** **** ********* **** ******* ********. *** ** mention **** **** ** *** ***'* **** ******/******* ********** ***** would ** ** *** ******** ***** * ********** ******** **** within *** ***** ** *** * ********* ******.

**** ********* ***** **** * **** ***** **** **** *** proprietary ** ***** ********** ****** ******** *** ****. ** *** example ********* *** * ** ******* ** ****** **** *** Panasonic ******* **** * ******* *** ** **** *** *****, IP, *** *** ** **. **** ***** ** ***** *** cameras ** **** **** ********** ** ** ******* **** ** rtsp ******* *********, ***********, ** **** *********, ***, ***. *** of *** ***** ***** ****** **** ********* ******* *** *** major *** ******** ***** *** **** ******* ****** ** **** rtsp ****** ********* ** **** ***** ** ****** *** **** reliable **** "********" **** **** ******* *** *** ***** ** the ******* ***** *******.

** * **** ****** *** * **** ***** (*** ***** sarcastic) *** ***** *** *** ****** **** *** *** ** get *** *** **** **** *** *** *** *** *****. most ** ** **** ****** **** *** *** ***** ** other ******** ** *** ****** **** ***.

********* ... *** * *** ******* ** ***** ***** **** including **** **** **** *** **** ***'*.

**** ** *** ***** *** *********.

***** ****! ** ** ( *** :) ***** *****, * totally *** **** **** *** *******, "**** * **** ********* that **** * ***** *********!" *************, *'* *** * *** in *** *****, *** * ******** **** ******* ***** ** something **** ******* ** * ***** ******, **, ****** * more *********** ********, *** **** **** **** ** ****. *** example, **** ***** * ******* * **** ***** * *** about ********* * ***** *******, * ****************** **** ** ****.

*'* ******* **** **** ******* ********* * **** ***** ** skill ****** *** ********** (*** *******, ***"***-***-****"). ******** ***** ***** ** **** *** ***'* *** * benefit, ****** **** *** ***** *** ********** ******, ******* **** stimulate **** *********** *** *** **** ** ** ** ******** to ** ***** * ****** ** **** *******.