IP Cameras Pentesting Report - Revision history

NKirnbauer: fixed link

2024-11-22T23:26:15Z

fixed link

← Older revision		Revision as of 23:26, 22 November 2024
Line 161:		Line 161:
	*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/		*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
	*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51		*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
	*~~http://web.archive.org/web/20220520011024/~~https://support.blinkforhome.com/~~en_US~~/~~before~~-~~you~~-~~begin~~/~~blink-technical~~-~~specifications~~		*https://support.blinkforhome.com/en_GB/f-a-q/system-requirements
	*http://web.archive.org/web/20210929005300/https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera		*http://web.archive.org/web/20210929005300/https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera

	[[Category:Pentesting]]		[[Category:Pentesting]]

NKirnbauer: expired links changed with links from wayback machine

2024-10-14T14:45:54Z

expired links changed with links from wayback machine

← Older revision		Revision as of 14:45, 14 October 2024
Line 161:		Line 161:
	*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/		*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
	*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51		*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
	*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications		*http://web.archive.org/web/20220520011024/https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
	*https://www.abus.com/at/~~Sicherheit~~-~~Zuhause~~/~~Videoueberwachung~~/~~Ueberwachungskameras~~/WLAN-~~Netzwerkkameras~~/WLAN-~~Schwenk~~-~~Neige~~-~~Kameras~~/ABUS-Smart-Security-World-~~WLAN~~-~~Innen~~-~~Schwenk~~-~~Neige~~-~~Kamera~~		*http://web.archive.org/web/20210929005300/https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera

	[[Category:Pentesting]]		[[Category:Pentesting]]

NKirnbauer: expired link changed with link from wayback machine

2024-10-14T14:29:42Z

expired link changed with link from wayback machine

← Older revision		Revision as of 14:29, 14 October 2024
Line 14:		Line 14:
	** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]		** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
	* <b>Cameras:</b>		* <b>Cameras:</b>
	** [https://www.abus.com/at/~~Sicherheit~~-~~Zuhause~~/~~Videoueberwachung~~/~~Ueberwachungskameras~~/WLAN-~~Netzwerkkameras~~/WLAN-~~Schwenk~~-~~Neige~~-~~Kameras~~/ABUS-Smart-Security-World-~~WLAN~~-~~Innen~~-~~Schwenk~~-~~Neige~~-~~Kamera~~ ABUS PPIC32020]		** [http://web.archive.org/web/20210929005300/https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera ABUS PPIC32020]
	** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]		** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

JKasser at 16:49, 26 July 2022

2022-07-26T16:49:11Z

← Older revision		Revision as of 16:49, 26 July 2022
Line 158:		Line 158:
	== References ==		== References ==

	* https://wikipedia.org
	* https://google.com
	*https://www.invicti.com/blog/web-security/http-security-headers/		*https://www.invicti.com/blog/web-security/http-security-headers/
	*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/		*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/

JKasser at 13:51, 14 July 2022

2022-07-14T13:51:57Z

← Older revision		Revision as of 13:51, 14 July 2022
Line 82:		Line 82:
	! <b>NMAP Command</b> !! <b>ABUS PPIC32020</b> !! <b>TP-Link NC200</b> !! <b>Blink Mini</b>		! <b>NMAP Command</b> !! <b>ABUS PPIC32020</b> !! <b>TP-Link NC200</b> !! <b>Blink Mini</b>
	\|-		\|-
	\| Port Scan \|\| [[File:ABUS_Port1.png]] <br><br> [[File:ABUS_Port2.png]] <br><br> We can see that all ports on both IP Addresses are closed. \|\| [[File:TP_Service.png]] <br><br> We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. \|\| [[File:Blink_OS_Port.png]] <br><br> We can see that no ports are open and accessible.		\| Port Scan \|\| [[File:ABUS_Port1.png\|border\|500px]] <br><br> [[File:ABUS_Port2.png\|border\|500px]] <br><br> We can see that all ports on both IP Addresses are closed. \|\| [[File:TP_Service.png\|border\|500px]] <br><br> We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. \|\| [[File:Blink_OS_Port.png\|border\|500px]] <br><br> We can see that no ports are open and accessible.
	\|-		\|-
	\| OS Scan \|\| [[File:ABUS_OS1.png]] <br><br> [[File:ABUS_OS2.png]] <br><br> No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. \|\| [[File:TP_OS.png]] <br><br> OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] \|\| [[File:Blink_OS_Port.png]] <br> <br> No definite OS Guess, some suggestions.		\| OS Scan \|\| [[File:ABUS_OS1.png\|border\|500px]] <br><br> [[File:ABUS_OS2.png\|border\|500px]] <br><br> No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. \|\| [[File:TP_OS.png\|border\|500px]] <br><br> OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] \|\| [[File:Blink_OS_Port.png\|border\|500px]] <br> <br> No definite OS Guess, some suggestions.
	\|-		\|-
	\| Vulnerability Scan \|\| [[File:ABUS_Vuln1.png]] <br><br> [[File:ABUS_Vuln2.png]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. \|\| [[File:TP_Vuln.png]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] \|\| [[File:Blink_Vuln.png]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]		\| Vulnerability Scan \|\| [[File:ABUS_Vuln1.png\|border\|500px]] <br><br> [[File:ABUS_Vuln2.png\|border\|500px]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. \|\| [[File:TP_Vuln.png\|border\|500px]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] \|\| [[File:Blink_Vuln.png\|border\|500px]] <br><br> Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
	\|}		\|}

Line 112:		Line 112:

	* <b>Smartphone located inside Network:</b>		* <b>Smartphone located inside Network:</b>
	[[File:InsideNetwork.jpg]]<br><br>		[[File:InsideNetwork.jpg\|border\|500px]]<br><br>
	If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.		If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
	* <b>Smartphone located outside Network:</b>		* <b>Smartphone located outside Network:</b>
	[[File:OutsideNetwork.jpg]]<br><br>		[[File:OutsideNetwork.jpg\|border\|500px]]<br><br>
	If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.		If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

	== Exploitation ==		== Exploitation ==

			{\| class="wikitable" style="float:right; margin-left: 10px;"
			\| [[File:HTTP.jpg\|border\|500px]]
			\|-
			\| Traffic capture from MitM attack. Here we can see the exposed admin user with the base64 encoded password.
			\|-
			\| [[File:Base64.jpg\|border\|200px]]
			\|-
			\| Screenshot of the Base64 Decoding. This results in the password "admin". So the user used the credentials username= "admin" password = "admin".
			\|}

	First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.		First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
	After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.		After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
	~~[[File:HTTP.jpg]]<br><br>~~
	Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.<br>		Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.<br>
	~~[[File:Base64.jpg]]<br><br>~~

	Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.		Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.
Line 131:		Line 140:
	The combined number of cameras tested are 3, all with their own functionalities.		The combined number of cameras tested are 3, all with their own functionalities.

	ABUS PPIC32020:		<b>ABUS PPIC32020:</b><br>
	Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.		Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

	TP-LINK NC250:		<b>TP-LINK NC250:</b><br>
	Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.		Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

	Blink-Mini:		<b>Blink-Mini:</b><br>
	Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.		Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

	Risk:		<b>Risk:</b><br>
	The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.		The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

	Countermeasure:		<b>Countermeasure:</b><br>
	The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.		The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.<br>
	Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.		Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.<br>

	~~== Courses ==~~

	* [[A course where this documentation was used]] (2017, 2018)
	* [[Another one]] (2018)

	== References ==		== References ==

NFaustino: /* Exploitation */

2022-07-14T12:20:00Z

Exploitation

← Older revision		Revision as of 12:20, 14 July 2022
Line 122:		Line 122:
	After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.		After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
	[[File:HTTP.jpg]]<br><br>		[[File:HTTP.jpg]]<br><br>
	Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.		Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.<br>
	[[File:Base64.jpg]]<br><br>		[[File:Base64.jpg]]<br><br>

NFaustino: /* Exploitation */

2022-07-14T12:18:07Z

Exploitation

← Older revision		Revision as of 12:18, 14 July 2022
Line 123:		Line 123:
	[[File:HTTP.jpg]]<br><br>		[[File:HTTP.jpg]]<br><br>
	Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.		Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.
			[[File:Base64.jpg]]<br><br>

	Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.		Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

NFaustino: /* Exploitation */

2022-07-14T12:16:40Z

Exploitation

← Older revision		Revision as of 12:16, 14 July 2022
Line 120:		Line 120:
	== Exploitation ==		== Exploitation ==
	First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.		First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
	After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user. Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.		After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
			[[File:HTTP.jpg]]<br><br>
			Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.

	Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.		Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

JKasser: /* Exploitation */

2022-07-13T21:36:21Z

Exploitation

← Older revision		Revision as of 21:36, 13 July 2022
Line 119:		Line 119:

	== Exploitation ==		== Exploitation ==
	First of all, to exploit the vunerability we have discovered for the ~~TP_Link~~ camera, you have to be in the same network as the target machine.		First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
	After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user. Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.		After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user. Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.

	Now ~~wit~~ all the data we have as the attacker you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can ~~observer~~ the ~~victime~~ any time. Furthermore, you have the access to all the other additional functions that the camera provides.		Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

	== Conclusion, Report and recommended Countermeasures ==		== Conclusion, Report and recommended Countermeasures ==

NFaustino: /* Exploitation */

2022-07-13T19:13:07Z

Exploitation

← Older revision		Revision as of 19:13, 13 July 2022
Line 119:		Line 119:

	== Exploitation ==		== Exploitation ==
			First of all, to exploit the vunerability we have discovered for the TP_Link camera, you have to be in the same network as the target machine.
			After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user. Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.

			Now wit all the data we have as the attacker you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observer the victime any time. Furthermore, you have the access to all the other additional functions that the camera provides.

	== Conclusion, Report and recommended Countermeasures ==		== Conclusion, Report and recommended Countermeasures ==