📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter

RTSP - Port 554, 8554

Basic info

The Real-Time Streaming Protocol (RTSP) is a network control protocol designed for establishing and managing media sessions between endpoints. Predominantly utilized in entertainment and communication systems, RTSP enables clients to issue commands such as play, pause, and record to control media streaming from servers. While RTSP itself does not handle the transmission of streaming data, it often works in conjunction with protocols like the Real-time Transport Protocol (RTP) and Real-time Control Protocol (RTCP) to facilitate media stream delivery.​

Default Ports: RTSP typically operates over ports 554 and 8554.​

Enumerating RTSP Services

Effective enumeration is a critical step in assessing RTSP services. The following methodologies and tools are instrumental in this process:​

Nmap Scripting Engine (NSE)

Nmap offers specialized scripts tailored for RTSP enumeration:​

nmap -sV --script "rtsp-*" -p <PORT> <TARGET-IP>

This command probes the specified port on the target IP, utilizing RTSP-specific scripts to gather pertinent information about the RTSP service.​

Manual Interaction with RTSP Services

Direct interaction with RTSP services can yield valuable insights:​

  1. Sending a DESCRIBE Request: The DESCRIBE method retrieves the media description of the requested resource.

    DESCRIBE rtsp://<TARGET-IP>:<PORT>/ RTSP/1.0
CSeq: 2

    A successful response provides details about the media stream, including codec information and available control methods.

  2. Handling Authentication Challenges: If the server requires authentication, it will respond with a 401 Unauthorized status, indicating the authentication scheme (e.g., Basic or Digest).

    • Basic Authentication: Credentials are encoded in Base64.​

      DESCRIBE rtsp://<TARGET-IP>:<PORT>/ RTSP/1.0
CSeq: 2
Authorization: Basic <BASE64_ENCODED_CREDENTIALS>

      Replace <BASE64_ENCODED_CREDENTIALS> with the Base64-encoded string of username:password.

    • Digest Authentication: Involves a challenge-response mechanism where the client must compute a response based on the server's nonce value.​

Automated Enumeration Tools

Several tools facilitate automated enumeration and assessment of RTSP services:​

  • Cameradar: An RTSP surveillance camera access tool that detects open RTSP hosts, retrieves public information, and attempts to access their streams.​

    Features include:​

    • Detection of open RTSP hosts on accessible targets.​

    • Retrieval of host information such as hostname, port, and camera model.​

    • Automated dictionary attacks to discover stream routes and credentials.​

    • Generation of thumbnails for quick content previews.​

Vulnerability Assessment and Exploitation

Assessing RTSP services for vulnerabilities involves several key considerations:​

Brute-Force Attacks on Authentication

RTSP services that require authentication may be susceptible to brute-force attacks:​

  • rtsp_authgrinder: A tool designed to perform brute-force attacks against RTSP authentication mechanisms.​

  • Cameradar: In addition to enumeration, Cameradar can execute dictionary attacks to uncover valid credentials.​

hydra -l root -P passwords.txt <IP> rtsp

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉

  • Become VeryLazyTech member! 🎁

PreviousApple Filing Protocol (AFP) - PORT 548NextIPMI - Port 623/UDP/TCP

Last updated

Was this helpful?