DΛΣMӨП

// HackTricks · Network Services

554,8554 - Pentesting RTSP

554,8554 - Pentesting RTSP

Basic Information

From wikipedia:[1]

The Real Time Streaming Protocol (RTSP) is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. The protocol is used for establishing and controlling media sessions between end points. Clients of media servers issue VHS-style commands, such as play, record and pause, to facilitate real-time control of the media streaming from the server to a client (Video On Demand) or from a client to the server (Voice Recording).

The transmission of streaming data itself is not a task of RTSP. Most RTSP servers use the Real-time Transport Protocol (RTP) in conjunction with Real-time Control Protocol (RTCP) for media stream delivery. However, some vendors implement proprietary transport protocols. The RTSP server software from RealNetworks, for example, also used RealNetworks’ proprietary Real Data Transport (RDT).

[1]

Default ports: 554,8554

PORT    STATE SERVICE
554/tcp open  rtsp

Key Details

RTSP is similar to HTTP but designed for control of media sessions. RTSP 2.0 is standardized in RFC 7826, which obsoletes the older RFC 2326 still implemented by many devices.[4]

The original RTSP 1.0 specification is RFC 2326.[4]

Devices might allow unauthenticated or authenticated access. To check, a “DESCRIBE” request is sent. A basic example is shown below:

DESCRIBE rtsp://<ip>:<port> RTSP/1.0\r\nCSeq: 2

Remember, the correct formatting includes a double “\r\n” for a consistent response. A “200 OK” response indicates unauthenticated access, while “401 Unauthorized” signals the need for authentication, revealing if Basic or Digest authentication is required.

For Basic authentication, you encode the username and password in base64 and include it in the request like so:

DESCRIBE rtsp://<ip>:<port> RTSP/1.0\r\nCSeq: 2\r\nAuthorization: Basic YWRtaW46MTIzNA==

This example uses “admin” and “1234” for the credentials. Here’s a Python script to send such a request:

import socket
req = "DESCRIBE rtsp://<ip>:<port> RTSP/1.0\r\nCSeq: 2\r\nAuthorization: Basic YWRtaW46MTIzNA==\r\n\r\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.1", 554))
s.sendall(req.encode())
data = s.recv(1024)
print(data)

Basic authentication is simpler to test but only Base64-encodes credentials and therefore requires TLS for confidentiality. Digest avoids sending the clear password but still needs correct nonce, realm, URI, and algorithm handling; prefer the strongest mechanism the device supports over a protected transport.[5]

This overview simplifies the process of accessing RTSP streams, focusing on Basic authentication for initial validation.[5]

Enumeration

Enumerate supported methods and candidate media URLs, then perform bounded credential testing only when it is authorized.

nmap -sV --script "rtsp-*" -p <PORT> <IP>

For path discovery specifically, rtsp-url-brute sends DESCRIBE requests for entries in its URL dictionary and reports the response classes.[2]

Viewing the RTSP stream with ffplay [6]

Once you’ve discovered a valid RTSP path (e.g., /mpeg4, /live.sdp) and confirmed access (unauthenticated or with credentials), you can use ffplay to stream the feed:

ffplay -rtsp_transport tcp rtsp://<IP>/mpeg4 -x 2560 -y 1440
  • -rtsp_transport tcp: Use TCP instead of UDP for more reliable streaming
  • -x, -y: Optional flags to control video resolution
  • Replace <IP> and path as needed

Brute Force

Other useful programs

For bounded credential testing, rtsp_authgrinder is one available tool.[7]

Cameradar[3]

  • Detect open RTSP hosts on any accessible target
  • Get their public info (hostname, port, camera model, etc.)
  • Launch automated dictionary attacks to get their stream route (for example /live.sdp)
  • Launch automated dictionary attacks to get the username and password of the cameras
  • Generate thumbnails from them to check if the streams are valid and to have a quick preview of their content
  • Try to create a Gstreamer pipeline to check if they are properly encoded
  • Print a summary of all the information Cameradar could collect

See also

32100 Udp Pentesting Pppp Cs2 P2P Cameras

References