All right, welcome back, everyone.
This is fresh air and this session is about getting started, which showed him and will force the strong
start with finding the Web cameras, I mean, IP cameras and try to get access into it.
All right, let's get started.
OK, so here it is.
We'll get it.
Simple.
We just have to go to these children, dot, dot, dial and.
Yeah, and yes.
And once you go to this or not, I, you just have to sign up and once you sign up to the account,
you get this right.
You get to see this lovely dashboard here.
And what do you need to do?
The first thing that you have to start with is always search for cameras.
Right.
So the most popular keyword for this is the webcam type webcam.
There are some keywords that I keep making use of.
And once you hit that, this will give you the result.
Multiple search results.
What do you see on the left?
That is a more specific filters.
So just like you can see the number of results came in from China and then we have Suzlon and United
States as well.
And, of course, the top services and the top organizations as well.
Right.
What do you see on the on the search result?
These are the results of individual devices, having the public IP address right now.
What are we actually trying to look for?
See, when you let's say, for example, we get into any of the device.
Right.
So let's say we go to maybe this one our.
Let's go to China for a while, we can possibly try to.
Let's let's try with this maybe.
OK, this seems to be something suspicious, I'll tell you why, because there was a key word called
honeypot.
That means it was intentionally created webcam, vulnerable webcam.
Right.
So even that happened to so.
Oh, right.
So this is also an important because you see some organizations that are in the security, they make
this to attract the hackers and see the patterns as well.
Right.
So Workcamps, let's try this if we get some details.
OK.
So this is this device.
This webcam belongs here in France and we get the public IP address, what we could what we can do with
this.
Now, understand this first, this search results keep changing every day, every every hour as well.
Right.
So if you try at this moment, you might find some different results.
You would be lucky if you even see the images, live images as well, or probably an open, open Web
camera.
What do you need to do in that case?
Well, I'll show you what exactly you would get.
So let's say in this could be any of the Web camera or any of the results just on the bottom, you would
find the live image or probably in image.
And once you get that, you just have to click on the, you know, this button and you get the access
to it.
There are some some different cases as well where and it could be a private Web camera.
When I say private, it might be exposed to the Internet, but you wouldn't be having the credentials,
the right places for it.
And for that being an ethical hacker or hacker, you would need to perform some sort of brute force
attack or study attack to possibly get the right credentials for this.
Right.
Let's say you got the right webcam or your target as well.
Now, if you try accessing this on your browser, you won't get the right access most of the time.
OK, but my point is to tell you exactly what you need to try to see the the when you try something
on the Web browser, what do you need to remember is what Beaudet is working.
So when I say that, it means usually SCDP works.
Of course, the default mode for a step is eighty four steps is four for three.
And that is if it is the the organization or the webcam might use non default points as well.
So it can even use eighty eighty eight thousand nine thousand eight thousand one as well.
So if you want to get access to it, you have to specify the boats on the browser as well, just after
the IP address.
But a boat number, if you don't specify it, will by default take 80.
And if your service is not working on that, it won't really open.
So in that case, how do we verify that it's working on Radio four for three?
Well, in our case, at working on both 80 and 80 and eighty eight in that case, even if you drive
with this, it might work lovely.
You can see this, you can get the access to it.
And it is asking for the details as well.
Right.
So this is saying some some location, I'm not really sure, but this belongs to some different organization.
But what you can try to do is if somehow you get the make it, you could try.
You can start with the default password.
So, for example, you can start with maybe Netgear if you get to know by the banner, if it's a Netgear,
you can see what's in it.
Go default password.
Oh, sorry.
I would say it's a webcam of another organizations or maybe will exist fast can default password both
for scam.
Sorry.
So the password.
Yeah.
So usually you usually get the idea right.
If you know about the vendor you can start with the default password.
If you, if it doesn't work you can start with your brute force.
Right.
In our case we can, we have to try doing with multiple devices.
What really happened is with the free account you can search for limited devices.
Right.
So you have to be sure about it.
If you are into security research or something, you better you buy for the premium program.
Where in.
You can go even more research so you can even drive a camera as well as a result, and you might find
some more results for the camera.
You also get.
With cameras, you also get some more results with it and let me show you.
There's some more details, so in this case, it's, again, working their.
Let me open this, this seems to be anybody you see this, so even if you try to be aware that it might
be a tracking device, might be tracking devices, and there are multiple vulnerabilities with that.
Right.
So it might be intentionally vulnerable devices.
And this is giving you a lot of other results as well.
Right.
So that's how you can look for results.
Now, what if you just want to be specific about remember it just that we are we are trying accessing
the devices at a different moment.
When you look at it, you will you might find more vulnerable devices even there like captions as well.
Right.
So let's do something.
If you want to be specific about just one single country, maybe I just want to get the result of United
States.
OK, so we can be specific about this with this country.
I can be specific about let's say I just want to result from United States.
So I type that Afghan country, US Country Club and us and I only see the results from United States.
You see this on this location, right?
So this is what I get.
But this doesn't seem to be blowing directly to the webcam.
I can even try for some other countries.
Maybe you can be is searching for some other location, some other countries as well, with the same
idea.
And you can even drive it to India.
And yeah.
So this is how you getting the results as well
to.
Oh, this, again, looks like an all out war.
There are a lot of ports open and this seems to be honeypot for sure.
And so this is how you can be specific related to country.
So let's say we going to go in more details about the cities as well so we can even search for Biggin,
make it even more specific with the city, so you can make it the keyword.
And let's say we would like to go for Myanmar and there we go.
Oh, so this seems like there's no results for for me at this moment of we have.
We do have.
Right.
So there was missing space in between.
And we only see the webcam belongs to the United States and in Miami location.
Right.
So if you look at it closely, you find multiple ports open.
Right.
25, which is usually for sending e-mails with S&P 80s again.
Sudeep, there are many other ports open as well.
This might work.
You can try to see what this device belongs to.
And this doesn't look like a good one for sure.
You can remove that.
And there are similar to this.
There are many devices.
This seems like media casts to live streaming and everything.
Right.
That's all it's about.
Now, you can be very specific about an organizations as well.
So let me show you.
You can even copy certain organization to let's say there is this one, OK?
And in this case, there seems to be.
This seems to be.
But let's try and just to show you how that could work.
You can make use of organization as a key word and specify that we here and here we go.
You can just be straight and you will only see the results specific to that organization.
Right.
So you see everything on the webcam results with that organization only.
All right.
So and you even see the keywords related to this.
And most of them are honeypots to be made with this.
Now, let me show you something different.
Once you click on Explorer, you will find a downloaded results and recently share, right.
So you can see a webcam.
Is the widely used keywords very much popular, right.
So then if you are looking to, you know, capture some webcam images or something, webcam as highly
effective depends on the day you are looking for.
So a webcam is the one then you can try for Kamps as well.
Not Gamma's one.
Many other.
Let's see if this works.
Wonderful.
We just tried with Cam and you could see.
All right.
So this seems to be have working with many bored straight when you do usually goes for a search, then
you can possibly go for many of the reports.
DCP Oh yeah, there is some polls open in two four eight zero as well.
This seems to be a step because that's the header, it seems.
So you can even try that.
I'm sure you different probability so that once you get into it, you will you do for it, too, and
you might find or walk one foot, so you get to see the access to the back.
Now, what you need is you always need the right credentials.
Of course, what I'm really talking about is the hacking line.
And this is what we really have to work on being in Hacker.
Right.
We need to see how effectively we can crack the password.
Right.
And this is what the real challenges comes.
You know, this is where the real creativity comes in as well.
Right.
So you got the idea about the default boats and the non default ports making use of it, how to get
access to it.
Right.
And this is where you will get access to all the top voted recently, shared keyboards as well.
And I hope you got the idea about how to get get access or how to possibly get to see about the IP cameras
over the shoulder as well.
Right.
So we'll keep making use of SHODAN information for scanning many of the devices as well.
Then keep learning.
We'll see you then.
Thank you.