Hack Like a Pro:

Hack Like a Pro: How to Find Vulnerable Webcams Across the Globe Using Shodan

Welcome back, my fledgling hackers!

I have already introduced you to Shodan, the world's most dangerous search engine. As you remember, Shodan indexes the information from the banners it pulls from web-enabled devices. These include routers, switches, webcams, traffic lights, SCADA systems, and even home security systems.

In my last post, I showed you how to find specific routers at a specific location, at a specific IP. In this tutorial, we will look to find webcams that are either unprotected or will allow us to log in with the default credentials, so come along a ride in voyeurism via the World Wide Web!

Step 1: Log in to Shodan

First, we need to log in to shodanhq.com. Although you can use Shodan without logging in, Shodan restricts some of its capabilities to only logged-in users.

Image via wonderhowto.com

Step 2: Search for Webcams

There are many ways to find web cams on Shodan. Usually, using the name of the manufacturer of the webcam is a good start. Remember, Shodan indexes the information in the banner, not the content. This means that if the manufacturer puts their name in the banner, we can search by it. If it doesn't, then the search will be fruitless.

One of my favorites is webcamxp, and when we type this into the Shodan search engine, it pulls up links to hundreds, if not thousands, of web-enabled webcams around the world!

Here is one from a rooftop in the Norway.

Here's another from a small shop in South Korea.

Image via wonderhowto.com

Although this can be fun and interesting to peek in—unbeknownst to these people around the world—we probably want to be more specific in our search for webcams.

Step 3: Default Webcam Username & Passwords

Although some of these webcams are unprotected, many of them will require authentication. The first step is to try the default username and password. I have compiled a short list of the default username and passwords of some of the most widely used webcams below.

  • ACTi: admin/123456 or Admin/123456
  • Axis (traditional): root/pass,
  • Axis (new): requires password creation during first login
  • Cisco: No default password, requires creation during first login
  • Grandstream: admin/admin
  • IQinVision: root/system
  • Mobotix: admin/meinsm
  • Panasonic: admin/12345
  • Samsung Electronics: root/root or admin/4321
  • Samsung Techwin (old): admin/1111111
  • Samsung Techwin (new): admin/4321
  • Sony: admin/admin
  • TRENDnet: admin/admin
  • Toshiba: root/ikwd
  • Vivotek: root/<blank>
  • WebcamXP: admin/ <blank>

There is no guarantee that these will work, but many inattentive and lazy administrators and individuals simply leave the default settings, and in those cases, these username and passwords will give you access to confidential and private webcams around the world!

Step 4: Search for Webcams by Geography

Now that we know how to find webcams and potentially log-in using the default username and passwords, let's get more specific and try to find webcams in a specific location. If we were interested in webcams by the manufacturer WebcamXP in Australia, we could find them by typing:

  • webcamxp country:AU

This will pull up a list of every WebcamXP in Australia that is web-enabled in Shodan's index as shown below.

Step 5: Narrow Your Search to a City

To be even more specific, we can narrow our search down to an individual city. Let's see what we can find in Sydney, Australia. We can find those webcams by typing:

  • webcamxp city:sydney

This search yields the results below.

When we click on one of these links, we find ourselves in someone's backyard in Sydney, Australia!

Step 6: Find Webcams by Longitude & Latitude

Shodan even enables us to be very specific in searching for web-enabled devices. In some cases, we can specify the longitude and latitude of the devices we want to find.

In this case, we will be looking for WebcamXP cameras at the longitude and latitude (-37.81, 144.96) of the city of Melbourne, Australia. When we search, we get a list of every WebcamXP at those coordinates on the globe. We must use the keyword geo followed by the longitude and latitude.

  • webcamxp geo: -37.81,144.96

When we get that specific, Shodan only finds four (4) WebcamXP cameras as shown below.

When we click on one, we can find that once again we have a private webcam view of someone's camera in their backyard in Melbourne, Australia.

I hope this short demonstration of the power Shodan gets your imagination stimulated for inventive ways you can find private webcams anywhere on the globe! Don't limit yourself to WebcamXP, but instead try each of the webcam manufacturers at a specific location and who knows what you will find!

Surveillance webcam image via Shutterstock

18 Comments

Uh, that's my backyard...

Just kidding, awesome post about Shodan. Can't wait to read the next one.

ghost_

Thanks for this great article master.
I was expecting 'How to find vulnerable website to heartbleed' as your next article.

Great post! Thx mate :)

iS shodan safe to use? or i have to use any proxies/vpns to hide myself?

Dragon:

Good question. If you are concerned about being tracked, use Shodan to get an IP and then hack it from behind a proxy/vpn.

OTW

can you make a tutorial about that? i think everyone would be interested in that :)

Great having your lecture skills on this site, great info, but any reason why i seem to always just get a browser hanging when i enter the ip in addy bar??

Attikus:

Sometimes when admins find that people have been accessing or hacking their web cams, they block access with a firewall.

OTW

ahh, ok thank you :) Keep gettin more n more candid w/ your knowledge, ive been following you for a while now love some of the recent stuff

Hi...
sorry for my bad english.. :D

if i want to use for ex nmap and i wuold to use a proxy, i can use the proxychain like in the guide that you have posted in the link in the upper comment..

but if i want to spy a webcam using shodan, i can't use proxychain right?
i have to use for ex tor browser and open shodan in tor browser or there is other way to do this??
thanks..

Yes, you can setup a VPN overall on your system without setting up anything else, OR you could find a good proxy and set your browser proxy settings and you are ready to go.

P.S:Tor is not so recommended anymore because of it's own vulnerabilities.

Ok thanks.. I know tor's problem and i know also that tor now is identified by Lot of security tools.. Can i do the proxychain also whit a good proxy for My browser or if i use a " browser" i can use only one proxy??

Thanks...

I tried this and didn't find any open cams, the search system isnt very good on this site either. Anyone know what Im doing wrong?

Darkfoxx:

No, it's not that the search system isn't very good. It's more that you have to be relatively specific in what you're looking for and follow the keys.

It's a great search engine, just takes a bit of a think to get to know how it works. Reading Occupy the Web's articles about it should clear some things up.

ghost_

Did you read my articles on Shodan and understand that it uses a different indexing system and search terms than Google?

What to do if I see this?

JOP

OTW

Dose the 'xp' in 'webcamxp' represent Windows XP system? If I want to control a webcam around me,such as my school,is any way to achieve it by shadon? And what kind of info I need to know before doing it?

Charles

Share Your Thoughts

  • Hot
  • Latest