Cameradar reports invalid RTSP credentials as successful (false positive)

[testsia]

Hello,

I am testing Cameradar on my own test IP cameras and would like to report what appears to be an issue in the RTSP authentication detection logic.

Problem summary:
Cameradar sometimes reports RTSP credentials as “successful” even though they are not valid. From my observation, the tool seems to use the first username/password entries from the credentials dictionary and marks them as valid, while the camera actually requires authentication and rejects those credentials.

Observed behavior:

• Cameradar discovers an RTSP endpoint
• Receives HTTP 200 responses on DESCRIBE
• Concludes that no authentication is required or that credentials are valid
• Displays dictionary credentials as “successful”
• However, when the same RTSP URL is tested in VLC, the credentials are rejected and VLC prompts again for authentication

Example Cameradar logs (debug mode):

Loading credentials...ok
Loaded 15 usernames and 3 passwords

Scanning the network...ok
Found 1 RTSP streams

DESCRIBE rtsp://192.168.111.11:554// RTSP/1.0 > 0
Stream rtsp://:@192.168.111.11::554// uses no authentication method

DESCRIBE rtsp://administrator:11wbox123@192.168.111.11:554// RTSP/1.0 > 200
SETUP rtsp://administrator:11wbox123@192.168.111.11:554// RTSP/1.0 > 200

Device RTSP URL: rtsp://administrator:11wbox123@192.168.111.11:554//
Available: ✔

When opening the same URL in VLC:
rtsp://administrator:11wbox123@192.168.111.11:554

VLC prompts for credentials and rejects the above username/password as invalid.
Valid credentials entered manually in VLC work correctly.

Possible cause:
Cameradar appears to rely mainly on DESCRIBE / SETUP responses and does not verify actual RTP stream playback (PLAY), which can result in false positives for authentication success.

This behavior may mislead users during RTSP security assessments.

Thank you for your work on Cameradar.
I would be happy to provide additional logs or help with further testing.

[testsia]

OK

[Ullaakut]

Hello @testsia !

Could you try doing the same with the latest version of Cameradar (v6)? Since we switched from libcurl to gortsplib for our RTSP requests, there's a chance this would now work just fine on latest :)

If not, we can open a feature request to change the way we validate streams to actually try to read data from the stream itself.

[testsia]

Hi, thanks for your reply.
I'm using the latest version, but I'm getting the same message. There are many cameras with the same error. I can test it if needed. The file contained one login and password that could be used to log in. Test:

docker run --rm -t --net=host -v /tmp:/tmp ullaakut/cameradar:latest --targets xxx.151.138.211 --custom-credentials "/tmp/dictionaries/credentials_2.json" --custom-routes "/tmp/dictionaries/routes" --ports 554 
^[[48;1RSteps
━━━━━━━━━━━━━━━━····················  45% 4/6 complete
✓ Scan targets
✓ Attack routes
✗ Detect authentication
· Attack credentials
· Validate streams
✓ Summary

Logs
[INFO] Scan targets: Scanning targets for RTSP streams
[INFO] Scan targets: Found 1 RTSP streams
[INFO] Scan targets: Scan complete
[INFO] Attack routes: Attacking RTSP routes
[INFO] Attack routes: Finished route attacks
[INFO] Detect authentication: Detecting authentication methods
[ERROR] Detect authentication: performing describe request at "rtsp://xxx.151.138.211:554/": bad status code: 401 (Unauthorized)

Summary
Streams (0 accessible / 1 total)
Error: attacking devices: detecting authentication methods: performing describe request at "rtsp://xxx.151.138.211:554/": bad status code: 401 (Unauthorized)

docker run --rm ullaakut/cameradar:latest -v
Cameradar version 6.0.0

If you need anything else, let me know

[Ullaakut]

Hi! The error you're hitting is now the one described in #390 and fixed by #391. Could you give it a try using the image described in this ticket, run it in debug mode and send the output again? Sorry for the inconvenience 🙏 And thank you for your help :D

[testsia]

Thank you my friend It worked for me!!!! Are you planning to make changes to the main release?

[Ullaakut]

Yes, it looks like that fix is still incomplete in other aspects, so I will keep working on it but as soon as it's ready it will be merged into master and a 6.0.1 release will come out :) Thank you for trying it out!

[Ullaakut]

👋 @testsia !

The issue should now officially be fixed in https://github.com/Ullaakut/cameradar/releases/tag/v6.0.1 :)

Could you please retry with that version to confirm that it's still OK for your camera? 🙏

EDIT: a v6.0.2 with minor improvements since came out, should not impact the fix.

Either do docker pull ullaakut/cameradar:latest and run the command with that image, or specify ullaakut/cameradar:v6.0.2 to ensure it's using the fixed version.

[testsia]

Hi. It worked perfectly!
The camera is working.

I have an RVi-IPN16/2-PRO-4K (1.DN4.001.001, Build Date: 2017-03-18) and a new problem is arising with it.

2026-02-02T13:37:08Z [INFO] Startup: targets: 192.168.111.11                                                                                                                                                                     
2026-02-02T13:37:08Z [INFO] Startup: ports: 554                                                                                                                                                                                   
2026-02-02T13:37:08Z [INFO] Startup: custom-routes: /tmp/dictionaries/routes                                                                                                                                                      
2026-02-02T13:37:08Z [INFO] Startup: custom-credentials: /tmp/dictionaries/credentials.json                                                                                                                                       
2026-02-02T13:37:08Z [INFO] Startup: scan-speed: 4
2026-02-02T13:37:08Z [INFO] Startup: skip-scan: false
2026-02-02T13:37:08Z [INFO] Startup: attack-interval: 0s
2026-02-02T13:37:08Z [INFO] Startup: timeout: 2s
2026-02-02T13:37:08Z [INFO] Startup: debug: true
2026-02-02T13:37:08Z [INFO] Startup: ui: tui
2026-02-02T13:37:08Z [INFO] Startup: output: disabled
2026-02-02T13:37:08Z [STEP] Scan targets: Scanning targets for RTSP streams
2026-02-02T13:38:35Z [INFO] Scan targets: Found 1 RTSP streams
2026-02-02T13:38:35Z [DONE] Scan targets: Scan complete
2026-02-02T13:38:35Z [STEP] Attack routes: Attacking RTSP routes
2026-02-02T13:38:35Z [DBUG] Attack routes: DESCRIBE rtsp://192.168.111.11:554/0x8b6c42 RTSP/1.0 > 401
2026-02-02T13:38:35Z [INFO] Attack routes: Default route accepted for 192.168.111.11:554
2026-02-02T13:38:35Z [DONE] Attack routes: Finished route attacks
2026-02-02T13:38:35Z [STEP] Detect authentication: Detecting authentication methods
2026-02-02T13:38:36Z [DBUG] Detect authentication: DESCRIBE rtsp://192.168.111.11:554 RTSP/1.0 > 401
2026-02-02T13:38:36Z [INFO] Detect authentication: Detected digest authentication for 192.168.111.11:554
2026-02-02T13:38:36Z [DONE] Detect authentication: Authentication detection complete
2026-02-02T13:38:36Z [STEP] Attack credentials: Attacking credentials
2026-02-02T13:45:24Z [DBUG] Attack credentials: DESCRIBE rtsp://system:wbox123@192.168.111.11:554 RTSP/1.0 > 401
2026-02-02T13:45:25Z [DBUG] Attack credentials: DESCRIBE rtsp://system:Y5eIMz3C@192.168.111.11:554 RTSP/1.0 > 401
2026-02-02T13:45:25Z [DBUG] Attack credentials: DESCRIBE rtsp://192.168.111.11:@192.168.111.11:554 RTSP/1.0 > 401
2026-02-02T13:45:25Z [DBUG] Attack credentials: DESCRIBE rtsp://alex:423Go6vxkW@192.168.111.11:554 RTSP/1.0 > 401
2026-02-02T13:45:28Z [DBUG] Attack credentials: credential attempt failed for 192.168.111.11:554 (alex:e3qvcSoE59): performing describe request at "rtsp://alex:e3qvcSoE59@192.168.111.11:554": request timed out
2026-02-02T13:45:28Z [DONE] Attack credentials: Credential attacks complete
2026-02-02T13:45:28Z [STEP] Validate streams: Validating streams
2026-02-02T13:45:28Z [DBUG] Validate streams: DESCRIBE rtsp://192.168.111.11:554 RTSP/1.0 > error: bad status code: 401 (Unauthorized)
2026-02-02T13:45:28Z [EROR] Validate streams: performing describe request at "rtsp://192.168.111.11:554": bad status code: 401 (Unauthorized)
Summary
-------
Accessible streams: 0
• None

Other discovered streams: 1
• 192.168.111.11:554 (Lorex IP camera rtspd)
  Authentication: digest
  Routes: 
  Credentials: not found
  Availability: no
  Admin panel: http://192.168.111.11/

Error: attacking devices: validating streams: performing describe request at "rtsp://192.168.111.11:554": bad status code: 401 (Unauthorized)

During testing, Cameradar successfully:
detected RTSP streams,
accepted default routes,
detected Digest authentication correctly,
attempted credential attacks.
However, validation of the stream failed because the generated RTSP URL was malformed.
Specifically, the IP address and port were concatenated without a colon:

rtsp://192.168.111.11554
instead of the correct format:
rtsp://192.168.111.11:554

After investigation, I found that the issue comes from the custom routes definition. If a route is defined as:
rtsp://{ip}{port}

Cameradar generates an invalid RTSP URL.
When the route is explicitly defined as:
rtsp://{ip}:{port}/
the problem is resolved and URL generation works as expected.
So the issue is not in stream discovery or authentication, but in how routes are interpreted and combined when {ip} and {port} are used without an explicit colon separator.
This caused 401 Unauthorized errors during validation, even though authentication and credentials handling were otherwise correct.
I hope this feedback helps — let me know if you’d like me to test additional cases or provide logs.

[Ullaakut]

👋 @testsia From the logs, the RTSP URL seems correct:

2026-02-02T13:45:28Z [STEP] Validate streams: Validating streams
2026-02-02T13:45:28Z [DBUG] Validate streams: DESCRIBE rtsp://192.168.111.11:554 RTSP/1.0 > error: bad status code: 401 (Unauthorized)
2026-02-02T13:45:28Z [EROR] Validate streams: performing describe request at "rtsp://192.168.111.11:554": bad status code: 401 (Unauthorized)

The issue you're having is actually one I saw as well and fixed as part of v6.0.1, where the valid credentials trigger a timeout:

2026-02-02T13:45:28Z [DBUG] Attack credentials: credential attempt failed for 192.168.111.11:554 (alex:e3qvcSoE59): performing describe request at "rtsp://alex:e3qvcSoE59@192.168.111.11:554": request timed out
2026-02-02T13:45:28Z [DONE] Attack credentials: Credential attacks complete

When I saw this issue yesterday, it was because the route had a // which made the camera not respond. In your case it's different, there's no route specified. I think the issue might be the opposite actually, that a / is missing at the end 🤔

I will try something on an experimental branch, and let you know when you can test it :) Thanks again for your help!

[Ullaakut]

Please retry with this experimental image (pick the one that matches your OS architecture):

ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-386
ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-armv7
ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-armv6
ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-arm64
ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-amd64

[testsia]

2026-02-02T15:04:01Z [INFO] Scan targets: Found 1 RTSP streams
2026-02-02T15:04:01Z [DONE] Scan targets: Scan complete
2026-02-02T15:04:01Z [STEP] Attack routes: Attacking RTSP routes
2026-02-02T15:04:01Z [DBUG] Attack routes: DESCRIBE rtsp://192.168.111.11:554/0x8b6c42 RTSP/1.0 > 401
2026-02-02T15:04:01Z [INFO] Attack routes: Default route accepted for 192.168.111.11:554
2026-02-02T15:04:01Z [DONE] Attack routes: Finished route attacks
2026-02-02T15:04:01Z [STEP] Detect authentication: Detecting authentication methods
2026-02-02T15:04:01Z [DBUG] Detect authentication: DESCRIBE rtsp://192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:01Z [INFO] Detect authentication: Detected digest authentication for 192.168.111.11:554
2026-02-02T15:04:01Z [DONE] Detect authentication: Authentication detection complete
2026-02-02T15:04:01Z [STEP] Attack credentials: Attacking credentials
2026-02-02T15:04:02Z [DBUG] Attack credentials: DESCRIBE rtsp://192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:02Z [DBUG] Attack credentials: DESCRIBE rtsp://:423Go6vxkW@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:02Z [DBUG] Attack credentials: DESCRIBE rtsp://:e3qvcSoE59@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:03Z [DBUG] Attack credentials: DESCRIBE rtsp://:0000@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:03Z [DBUG] Attack credentials: DESCRIBE rtsp://:12345678A@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:04Z [DBUG] Attack credentials: DESCRIBE rtsp://:00000@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:04Z [DBUG] Attack credentials: DESCRIBE rtsp://:1111@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:04Z [DBUG] Attack credentials: DESCRIBE rtsp://:111111@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:05Z [DBUG] Attack credentials: DESCRIBE rtsp://:1111111@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:05Z [DBUG] Attack credentials: DESCRIBE rtsp://:123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:05Z [DBUG] Attack credentials: DESCRIBE rtsp://:1234@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:06Z [DBUG] Attack credentials: DESCRIBE rtsp://:12345@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:06Z [DBUG] Attack credentials: DESCRIBE rtsp://:123456@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:06Z [DBUG] Attack credentials: DESCRIBE rtsp://:1234567@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:07Z [DBUG] Attack credentials: DESCRIBE rtsp://:12345678@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:07Z [DBUG] Attack credentials: DESCRIBE rtsp://:123456789@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:08Z [DBUG] Attack credentials: DESCRIBE rtsp://:12345678910@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:08Z [DBUG] Attack credentials: DESCRIBE rtsp://:4321@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:08Z [DBUG] Attack credentials: DESCRIBE rtsp://:666666@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:09Z [DBUG] Attack credentials: DESCRIBE rtsp://:6fJjMKYx@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:09Z [DBUG] Attack credentials: DESCRIBE rtsp://:888888@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:09Z [DBUG] Attack credentials: DESCRIBE rtsp://:9999@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:10Z [DBUG] Attack credentials: DESCRIBE rtsp://:admin@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:10Z [DBUG] Attack credentials: DESCRIBE rtsp://:admin123456@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:11Z [DBUG] Attack credentials: DESCRIBE rtsp://:admin%20pass@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:11Z [DBUG] Attack credentials: DESCRIBE rtsp://:Admin@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:11Z [DBUG] Attack credentials: DESCRIBE rtsp://:admin123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:12Z [DBUG] Attack credentials: DESCRIBE rtsp://:administrator@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:12Z [DBUG] Attack credentials: DESCRIBE rtsp://:Administrator@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:12Z [DBUG] Attack credentials: DESCRIBE rtsp://:aiphone@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:13Z [DBUG] Attack credentials: DESCRIBE rtsp://:camera@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:13Z [DBUG] Attack credentials: DESCRIBE rtsp://:Camera@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:13Z [DBUG] Attack credentials: DESCRIBE rtsp://:fliradmin@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:14Z [DBUG] Attack credentials: DESCRIBE rtsp://:GRwvcj8j@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:14Z [DBUG] Attack credentials: DESCRIBE rtsp://:hikvision@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:15Z [DBUG] Attack credentials: DESCRIBE rtsp://:hikadmin@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:15Z [DBUG] Attack credentials: DESCRIBE rtsp://:HuaWei123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:15Z [DBUG] Attack credentials: DESCRIBE rtsp://:ikwd@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:16Z [DBUG] Attack credentials: DESCRIBE rtsp://:jvc@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:16Z [DBUG] Attack credentials: DESCRIBE rtsp://:kj3TqCWv@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:16Z [DBUG] Attack credentials: DESCRIBE rtsp://:meinsm@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:17Z [DBUG] Attack credentials: DESCRIBE rtsp://:pass@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:17Z [DBUG] Attack credentials: DESCRIBE rtsp://:Pass@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:17Z [DBUG] Attack credentials: DESCRIBE rtsp://:password@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:18Z [DBUG] Attack credentials: DESCRIBE rtsp://:password123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:18Z [DBUG] Attack credentials: DESCRIBE rtsp://:qwerty@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:19Z [DBUG] Attack credentials: DESCRIBE rtsp://:qwerty123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:19Z [DBUG] Attack credentials: DESCRIBE rtsp://:Recorder@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:19Z [DBUG] Attack credentials: DESCRIBE rtsp://:reolink@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:20Z [DBUG] Attack credentials: DESCRIBE rtsp://:root@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:20Z [DBUG] Attack credentials: DESCRIBE rtsp://:service@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:20Z [DBUG] Attack credentials: DESCRIBE rtsp://:supervisor@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:21Z [DBUG] Attack credentials: DESCRIBE rtsp://:support@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:21Z [DBUG] Attack credentials: DESCRIBE rtsp://:system@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:21Z [DBUG] Attack credentials: DESCRIBE rtsp://:tlJwpbo6@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:22Z [DBUG] Attack credentials: DESCRIBE rtsp://:toor@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:22Z [DBUG] Attack credentials: DESCRIBE rtsp://:tp-link@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:23Z [DBUG] Attack credentials: DESCRIBE rtsp://:ubnt@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:23Z [DBUG] Attack credentials: DESCRIBE rtsp://:user@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:23Z [DBUG] Attack credentials: DESCRIBE rtsp://:wbox@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:24Z [DBUG] Attack credentials: DESCRIBE rtsp://:wbox123@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:24Z [DBUG] Attack credentials: DESCRIBE rtsp://:Y5eIMz3C@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:24Z [DBUG] Attack credentials: DESCRIBE rtsp://666666:@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T15:04:25Z [DBUG] Attack credentials: DESCRIBE rtsp://666666:423Go6vxkW@192.168.111.11:554/ RTSP/1
2026-02-02T15:05:24Z [DONE] Attack credentials: Credential attacks complete
2026-02-02T15:05:24Z [STEP] Validate streams: Validating streams
2026-02-02T15:05:24Z [DBUG] Validate streams: DESCRIBE rtsp://192.168.111.11:554/ RTSP/1.0 > error: bad status code: 401 (Unauthorized)
2026-02-02T15:05:24Z [EROR] Validate streams: performing describe request at "rtsp://192.168.111.11:554/": bad status code: 401 (Unauthorized)
Summary
-------
Accessible streams: 0
• None

Other discovered streams: 1
• 192.168.111.11:554 (Lorex IP camera rtspd)
  Authentication: digest
  Routes: 
  Credentials: not found
  Availability: no
  Admin panel: http://192.168.111.11/

Error: attacking devices: validating streams: performing describe request at "rtsp://192.168.111.11:554/": bad status code: 401 (Unauthorized)

I think there's been a shift.

[Ullaakut]

Mh interesting, here it seems to have stopped in the middle of the attack phase 🤔 This log is incomplete 2026-02-02T15:04:25Z [DBUG] Attack credentials: DESCRIBE rtsp://666666:423Go6vxkW@192.168.111.11:554/ RTSP/1

Can you show me what command you run exactly?

[Ullaakut]

Ah, looking at the logs actually it seems there's a precisely 60s gap between the attempt that cuts short and the end of the attack phase:

2026-02-02T15:04:25Z [DBUG] Attack credentials: DESCRIBE rtsp://666666:423Go6vxkW@192.168.111.11:554/ RTSP/1
2026-02-02T15:05:24Z [DONE] Attack credentials: Credential attacks complete

So it is likely that it's timing out for some reason. This could simply be due to the camera trying to rate limit the attempts. Could you try with a smaller dictionary and/or an attack-interval set to something like 1s ?

[testsia]

Yes, I think I gave inaccurate information. I reduced the vocabulary.

sudo docker run --rm -t --net=host -v /tmp:/tmp ullaakut/cameradar:v6.0.2-SNAPSHOT-ede2fdc-amd64 --targets 192.168.111.11 --custom-credentials "/tmp/dictionaries/credentials_2.json" --custom-routes "/tmp/dictionaries/routes" --ports 554 --debug --attack-interval 1s
^[[49;1R2026-02-02T16:42:47Z [INFO] Startup: Running cameradar version 6.0.2-SNAPSHOT-ede2fdc, commit ede2fdc
2026-02-02T16:42:47Z [INFO] Startup: targets: 192.168.111.11
2026-02-02T16:42:47Z [INFO] Startup: ports: 554
2026-02-02T16:42:47Z [INFO] Startup: custom-routes: /tmp/dictionaries/routes
2026-02-02T16:42:47Z [INFO] Startup: custom-credentials: /tmp/dictionaries/credentials_2.json
2026-02-02T16:42:47Z [INFO] Startup: scan-speed: 4
2026-02-02T16:42:47Z [INFO] Startup: skip-scan: false
2026-02-02T16:42:47Z [INFO] Startup: attack-interval: 1s
2026-02-02T16:42:47Z [INFO] Startup: timeout: 2s
2026-02-02T16:42:47Z [INFO] Startup: debug: true
2026-02-02T16:42:47Z [INFO] Startup: ui: tui
2026-02-02T16:42:47Z [INFO] Startup: output: disabled
2026-02-02T16:42:47Z [STEP] Scan targets: Scanning targets for RTSP streams
2026-02-02T16:44:14Z [INFO] Scan targets: Found 1 RTSP streams
2026-02-02T16:44:14Z [DONE] Scan targets: Scan complete
2026-02-02T16:44:14Z [STEP] Attack routes: Attacking RTSP routes
2026-02-02T16:44:14Z [DBUG] Attack routes: DESCRIBE rtsp://192.168.111.11:554/0x8b6c42 RTSP/1.0 > 401
2026-02-02T16:44:14Z [INFO] Attack routes: Default route accepted for 192.168.111.11:554
2026-02-02T16:44:14Z [DONE] Attack routes: Finished route attacks
2026-02-02T16:44:14Z [STEP] Detect authentication: Detecting authentication methods
2026-02-02T16:44:14Z [DBUG] Detect authentication: DESCRIBE rtsp://192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:14Z [INFO] Detect authentication: Detected digest authentication for 192.168.111.11:554
2026-02-02T16:44:14Z [DONE] Detect authentication: Authentication detection complete
2026-02-02T16:44:14Z [STEP] Attack credentials: Attacking credentials
2026-02-02T16:44:14Z [DBUG] Attack credentials: DESCRIBE rtsp://userUA:12345678A@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:16Z [DBUG] Attack credentials: DESCRIBE rtsp://userUA:423Go6vxkW@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:17Z [DBUG] Attack credentials: DESCRIBE rtsp://userUA:e3qvcSoE59@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:18Z [DBUG] Attack credentials: DESCRIBE rtsp://alex:12345678A@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:20Z [DBUG] Attack credentials: DESCRIBE rtsp://alex:423Go6vxkW@192.168.111.11:554/ RTSP/1.0 > 401
2026-02-02T16:44:23Z [DBUG] Attack credentials: credential attempt failed for 192.168.111.11:554 (alex:e3qvcSoE59): performing describe request at "rtsp://alex:e3qvcSoE59@192.168.111.11:554/": request timed out
2026-02-02T16:44:23Z [DONE] Attack credentials: Credential attacks complete
2026-02-02T16:44:23Z [STEP] Validate streams: Validating streams
2026-02-02T16:44:23Z [DBUG] Validate streams: DESCRIBE rtsp://192.168.111.11:554/ RTSP/1.0 > error: bad status code: 401 (Unauthorized)
2026-02-02T16:44:23Z [EROR] Validate streams: performing describe request at "rtsp://192.168.111.11:554/": bad status code: 401 (Unauthorized)
Summary
-------
Accessible streams: 0
• None

Other discovered streams: 1
• 192.168.111.11:554 (Lorex IP camera rtspd)
  Authentication: digest
  Routes: 
  Credentials: not found
  Availability: no
  Admin panel: http://192.168.111.11/

Error: attacking devices: validating streams: performing describe request at "rtsp://192.168.111.11:554/": bad status code: 401 (Unauthorized)