We took over a property that had existing cameras through Hikvision and Axis however the old integrator did not document the passwords to the cameras.
We are unsure of how to get the camera passwords without having to order a lift and try and press the reset buttons.
Any suggestions on how to retrieve the passwords or an easier way to retrieve? I know on some of the Hikvision we can email support and they should be able to send a reset file. Not sure about Axis though.
First option would be to try default username and password and see if works
Is Axis Camera Manager running on any of the existing PCs? If so, the password may be saved in there.
No, unfortunately no Axis camera manager. Also, first thing we tried was default usernames and passwords. They have all been changed from factory.
Axis has no other password recovery method outside of physically hitting the reset button.
Hikvision does, as you alluded to, related Hikvision Responds To Cracked Security Codes.
how many cameras?
are they currently utilized in a production VMS? the vms stores the camera credentials and my VMS vendor advised they could obtain the passwords from our older system but it was going to cost me...
how quick do you need this done?
iif they are on old (vulnerable) firmware then maybe you will be lucky and can utilize some existing vulnerability to access some of them possibly.
i was in a similar situation recently with axis cams and was lucky enough to be able to guess a couple passwords which were common across large batches of cameras. axis device manager helped as it stores any password that works on any camera and will try all successful passwords against a group of cameras that you are trying to manage.
most of my cameras are in hard to reach areas so it would have been catastrophic to have to roll and reset them all.... good luck
As John mentioned, if you've lost the Axis password, you need to do a complete factory default. Unplug the camera, hold in the reset button, power the camera back up while keeping the button pressed. It's a large pain, but I understand with security concerns why it has to be that way. Hopefully you can bill for the time since you inherited the system.
Hi UI1,
If the cameras are running older firmware that still uses Basic authentication instead of Digest authentication, you can use Wireshark to get the username and password. Instead of running a trace on every camera and having to sort through it, you can do the following which will capture just Basic authentication usernames and passwords, decode them, and save them to a text file. The steps below assume a 64-bit OS and 64-bit version of Wireshark.
1. Install Wireshark (64-bit version) on the server(s) communicating to the cameras (typically the recording server).
2. Open a command prompt and type the following and press Enter:
cd "c:\program files\wireshark"
3. Type "dumpcap -D" and press Enter. This will return all of the network adapters. It will look something like this. The name at the end in parenthesis is the same name that shows up in the network settings within Windows. Take note of the number of the network adapter that is on the same network as your cameras.
4. Type the following at the command prompt. Change the "X" to the number of the network adapter you noted above.
tshark -i X -T fields -e ip.dst -e http.authbasic -Y "http.authbasic" > %USERPROFILE%\Desktop\CameraCredentials.txt
5. You will see something like this indicating that it is "Capturing on <name of NIC>":
6. Now, stop the recording service and start it back up. In most, if not all, VMSs this will force the recording service to try to authenticate to all of the cameras. At this point, if any cameras are using Basic authentication, you will see a number start appearing like the screenshot below. This indicates how many credentials it is capturing.
7. Once the recording service has been back up and running for a while (give it a few minutes to make sure it has connected to all of the cameras), press Ctrl+C on the command prompt window to stop the script.
8. Open the CameraCredential.txt file that should be on the desktop. If it has captured anything, it will look like this (it might capture the same credentials multiple times depending on how authentication is done). You can copy and paste this into Excel so you can do sorting and remove duplicates easier.
If it doesn't capture anything, you can try a different network adapter (in case you aren't certain of which network adapter the cameras are communicating on) or try it on another recording server. Odds are that most, if not all, of the cameras are set to the same password so if you can just find one camera that is set to Basic authentication, it should help across the board and save you from having to reset all of the cameras.
Also, if by chance stopping and starting the recording service doesn't force the recording server to authenticate to the cameras, you can try disabling and enabling the cameras. This takes more time but also usually forces an authentication.
Here is everything you need for Hikvision:
Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.