u/GustavoSr_12

Hi everyone,
I keep running into a recurring scenario in some CTFs involving IoT/IP Cams and could use some insight, specifically regarding those generic low-cost Chinese cameras (often running on Altobeam hardware).
The Scenario and Restrictions
The objective is to capture the camera's RTSP traffic. There is no possibility of pivoting to bypass IP restrictions (strict whitelisting is active in the environment), and so far, I haven't identified any exploitable public CVEs for the exposed version.
What I've achieved so far (Enumeration)
Initial access to the ONVIF service (when the port is open).
Successfully extracted the RTSP stream URL and the respective session tokens via SOAP API requests.
The Blocker
Even with the URL and tokens in hand, RTSP access systematically fails (connection timeout or drop). I've tried the following approaches without success:
Automated interactions with ONVIF to try and force the creation of new users or discover hidden endpoints, but the result is the same.
Performed traffic capture and analysis (PCAP) in promiscuous mode using ⁠tcpdump⁠ and Wireshark. My intention was to inspect the packets looking for some undocumented handshake, custom headers, or broadcast/multicast requests from the camera on the network, but I couldn't identify any clear byte patterns.
Did some deep digging and found that many of these devices require a proprietary handshake (usually UDP/P2P) performed exclusively by the manufacturer's official Android app before actually releasing the stream.
The Question
What am I missing regarding the architecture of these Altobeam cameras? Is there a standard process or specific tool to emulate this mobile app handshake and "wake up" the RTSP service, or does exploitation in these cases usually follow another vector (such as flaws in the ONVIF service implementation itself)?
Any direction, pointers, or study material on the internal network protocol workings of these generic cameras would be greatly appreciated. Thanks in advance!

Hi everyone,
I keep running into a recurring scenario in some CTFs involving IoT/IP Cams and could use some insight, specifically regarding those generic low-cost Chinese cameras (often running on Altobeam hardware).
The Scenario and Restrictions
The objective is to capture the camera's RTSP traffic. There is no possibility of pivoting to bypass IP restrictions (strict whitelisting is active in the environment), and so far, I haven't identified any exploitable public CVEs for the exposed version.
What I've achieved so far (Enumeration)
Initial access to the ONVIF service (when the port is open).
Successfully extracted the RTSP stream URL and the respective session tokens via SOAP API requests.
The Blocker
Even with the URL and tokens in hand, RTSP access systematically fails (connection timeout or drop). I've tried the following approaches without success:
Automated interactions with ONVIF to try and force the creation of new users or discover hidden endpoints, but the result is the same.
Performed traffic capture and analysis (PCAP) in promiscuous mode using ⁠tcpdump⁠ and Wireshark. My intention was to inspect the packets looking for some undocumented handshake, custom headers, or broadcast/multicast requests from the camera on the network, but I couldn't identify any clear byte patterns.
Did some deep digging and found that many of these devices require a proprietary handshake (usually UDP/P2P) performed exclusively by the manufacturer's official Android app before actually releasing the stream.
The Question
What am I missing regarding the architecture of these Altobeam cameras? Is there a standard process or specific tool to emulate this mobile app handshake and "wake up" the RTSP service, or does exploitation in these cases usually follow another vector (such as flaws in the ONVIF service implementation itself)?
Any direction, pointers, or study material on the internal network protocol workings of these generic cameras would be greatly appreciated. Thanks in advance!

Hi everyone,
I keep running into a recurring scenario in some CTFs involving IoT/IP Cams and could use some insight, specifically regarding those generic low-cost Chinese cameras (often running on Altobeam hardware).
The Scenario and Restrictions
The objective is to capture the camera's RTSP traffic. There is no possibility of pivoting to bypass IP restrictions (strict whitelisting is active in the environment), and so far, I haven't identified any exploitable public CVEs for the exposed version.
What I've achieved so far (Enumeration)
Initial access to the ONVIF service (when the port is open).
Successfully extracted the RTSP stream URL and the respective session tokens via SOAP API requests.
The Blocker
Even with the URL and tokens in hand, RTSP access systematically fails (connection timeout or drop). I've tried the following approaches without success:
Automated interactions with ONVIF to try and force the creation of new users or discover hidden endpoints, but the result is the same.
Performed traffic capture and analysis (PCAP) in promiscuous mode using ⁠tcpdump⁠ and Wireshark. My intention was to inspect the packets looking for some undocumented handshake, custom headers, or broadcast/multicast requests from the camera on the network, but I couldn't identify any clear byte patterns.
Did some deep digging and found that many of these devices require a proprietary handshake (usually UDP/P2P) performed exclusively by the manufacturer's official Android app before actually releasing the stream.
The Question
What am I missing regarding the architecture of these Altobeam cameras? Is there a standard process or specific tool to emulate this mobile app handshake and "wake up" the RTSP service, or does exploitation in these cases usually follow another vector (such as flaws in the ONVIF service implementation itself)?
Any direction, pointers, or study material on the internal network protocol workings of these generic cameras would be greatly appreciated. Thanks in advance!

Encomendei meu kit de pwnagotchi como ponto de partida nos meus estudos em cyber segurança.
Tem sido uma jornada muito interessante, aprendi sobre os protocolos de hash, utilizei o hashcat, wpa-sec etc…
Durante o processo também fui aprendendo muito sobre a segurança cibernética no geral, técnicas de MITM como o ARP spoof via bettercap, e monitorando pelo wireshark (infelizmente uso Windows ainda).
Tem sido uma jornada muito interessante, durante todo o processo fiz os testes na minha própria rede, e fui sendo ensinado pelo Gemini do Google.
Contudo, agora ele simplesmente não me ensina mais nada, gostaria de tentar interceptar dados da minha câmera Ip, ou de testar interceptar dados do meu celular mesmo.
Qualquer instrução agora ele fala que vai contra as diretrizes e etc, e isso está me desanimando de continuar aprendendo.
Eu realmente gostaria de tentar entrar em sites http no meu telefone e tentar interceptar as informações, ou a própria câmera Ip mesmo da minha rede.
Gostaria de saber se existe alguma IA mais aberta a esse tipo de coisa, e que de fato continue me ensinando a realizar esses procedimentos para eu não desanimar de estudar.