Your ONVIF and RTSP camera companion for discovering and hacking real-world security cameras 🎥
pwneye is a focused and portable offensive security tool for working with IP cameras that expose ONVIF and RTSP services, aiming to give security researchers and hackers an easy way to handle discovery, authentication testing, metadata collection, stream validation, recording, and follow-up actions from a single CLI workflow.
Some of the capabilities currently supported include:
ffplay, recording via ffmpeg, and snapshot capture~/.pwneyehttps://github.com/user-attachments/assets/6913632b-326d-455e-aa0d-be6bf9b3e66c
Install pwneye as a system-wide CLI command from GitHub:
pipx install git+https://github.com/Hackerest/pwneye.git
pwneye --help
Uninstall it:
pipx uninstall pwneye
Upgrade it later from the same GitHub source:
pipx upgrade pwneye
git clone https://github.com/Hackerest/pwneye
cd pwneye
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python3 pwneye.py --help
Upgrade it later from the same GitHub source:
cd pwneye
git pull
source .venv/bin/activate
pip install -r requirements.txt
The following tools are expected in PATH depending on the mode you use:
ffplayffprobeffmpeg for recording| Platform | Install command |
|---|---|
| macOS (Homebrew) | brew install ffmpeg |
| Ubuntu / Debian | sudo apt update && sudo apt install ffmpeg |
| Fedora | sudo dnf install ffmpeg ffmpeg-free |
| Arch Linux | sudo pacman -S ffmpeg |
| openSUSE | sudo zypper install ffmpeg |
Use these as the fastest entry points into the tool. The goal here is not to document every flag, but to show the most useful ways to start working with a camera depending on what you already know.
Start from the default full workflow when you have a single target and want pwneye to do the protocol selection work for you:
pwneye -t 192.168.1.135
Start from ONVIF discovery when you are on the same local network and want to identify devices, vendors, and stream clues before touching RTSP:
pwneye --discover
Start directly from RTSP when ONVIF is irrelevant, unavailable, or you already know what you want to test:
pwneye -t 192.168.1.135 --skip-onvif
Start from known or suspected credentials when you want to reduce noise and validate access quickly:
pwneye -t 192.168.1.135 --username admin --password admin
pwneye -t 192.168.1.135 --username admin --password ~/wordlists/passwords.txt
pwneye -t 192.168.1.135 --username ~/wordlists/users.txt --password admin123
Start from a known path or a path template when you already have a stream clue and want tight control over RTSP requests:
pwneye -t 192.168.1.135 --skip-onvif -cn "/live/ch00_0"
pwneye -t 192.168.1.135 --skip-onvif -cn '/cam/realmonitor?channel={channel}&subtype=0'
Start from evidence collection once a working stream is found:
pwneye -t 192.168.1.135 --snapshot
pwneye -t 192.168.1.135 --record
Useful flags to keep in mind:
--vendor VENDOR: reduce RTSP requests when the device family is already known-cn, --connection-string PATH: try a known RTSP path or a file containing candidate paths--multi-channel: prefer channel-based RTSP paths when you suspect a DVR/NVR-style target--threads N: control concurrency for ONVIF and RTSP bruteforce--skip-onvif / --skip-rtsp: focus on one protocol only--no-cache: do not read from or write to cache--fresh: ignore cache reads but still write new findingsONVIF is the management and control side of the camera world. In practice, it is useful for discovery, authentication, metadata extraction, media profile enumeration, stream URI retrieval, and device actions such as rebooting.
In pwneye, ONVIF is usually the protocol that gives the richest post-auth context, the cleanest path to understanding what a camera exposes, and, when the authenticated account has enough privileges, access to real administrative actions on the device.
When a camera exposes ONVIF, pwneye can use it to:
--reboot--reset--shell--deface--undefaceUse WS-Discovery to identify ONVIF-capable devices on the local network:
pwneye --discover