CamScan

CamScan is a Bash-based local network discovery tool for finding IP cameras, NVRs, and DVRs on networks you own or are authorized to test.

The script combines several discovery signals instead of relying on one port or banner. It can detect live hosts, look for ONVIF and mDNS services, scan common camera ports, fingerprint RTSP/HTTP services, probe known vendor endpoints, and score each host as a possible, likely, or confirmed camera device.

What It Does

• Scans a target subnet, range, or single host.
• Uses ARP discovery when available, with nmap ping sweep fallback.
• Sends ONVIF WS-Discovery probes for strong camera detection.
• Checks mDNS/Bonjour services.
• Scans common camera, recorder, RTSP, HTTP, and vendor ports.
• Fingerprints HTTP titles, server headers, RTSP responses, and vendor CGI/API paths.
• Exports results to CSV and JSON.
• Opens RTSP live view or captures snapshots when credentials and a stream path are available.

Safety Notice

CamScan is for discovery and auditing on authorized networks only. It does not attempt to log in during normal scanning. The --find-creds option is an explicit audit mode for checking known default credentials and should only be used on devices you own or have permission to test.

Requirements

CamScan is designed and tested around a Kali Linux environment. The tools and package names below follow Kali/Debian conventions, while the script also includes fallback package mappings for other supported systems where possible.

Required tools:

• bash
• nmap
• curl
• ip from iproute2
• timeout from coreutils

Optional tools:

• arp-scan for faster local host discovery and MAC vendor lookup
• socat for ONVIF WS-Discovery
• avahi-browse for mDNS/Bonjour discovery
• ffplay, mpv, or vlc for live viewing

The script can offer to install missing dependencies on supported systems, or you can run with --no-install to only warn about missing tools.

Usage

chmod +x camscan.sh
sudo ./camscan.sh

Scan once and export results:

sudo ./camscan.sh --once -o cams

Scan a specific subnet deeply:

sudo ./camscan.sh -t 192.168.1.0/24 -m deep

Run without host discovery:

./camscan.sh -t 192.168.1.0/24 --no-discovery

Open a known camera stream:

./camscan.sh --view 192.168.1.206 -U admin:password

Save a snapshot:

./camscan.sh --snapshot 192.168.1.206 -U admin:password --out cam.jpg

Output

When -o <prefix> is provided, CamScan writes:

• <prefix>.csv
• <prefix>.json

Each result can include IP address, MAC address, vendor, score, classification, open camera-related ports, ONVIF URL, HTTP banner/title, RTSP server, model, and evidence collected during fingerprinting.

Common Options

-t, --target <spec>      Target subnet, range, or host
-i, --interface <if>     Network interface to use
-m, --mode <mode>        fast, normal, or deep
-p, --ports <list>       Override scanned ports
-o, --output <prefix>    Write CSV and JSON output
-a, --all                Show all live hosts
-s, --min-score <n>      Set reporting threshold
-I, --menu               Force interactive menu
    --once               Scan, print, and exit
    --no-onvif           Skip ONVIF discovery
    --no-mdns            Skip mDNS discovery
    --no-discovery       Scan target range without host discovery
-w, --view <ip>          Open live view
    --snapshot <ip>      Capture one frame
-U, --creds <user:pass>  RTSP credentials
    --find-creds         Audit known default credentials on authorized devices

About This Script

This project is meant to make local camera inventory easier from a Linux terminal. It is useful when you need to locate unknown cameras, verify recorder devices, document camera-related services, or audit whether devices still expose default RTSP paths and vendor endpoints.

The scoring approach keeps the output practical: one weak signal may only mark a host as possible, while stronger evidence like ONVIF responses, camera-specific ports, RTSP banners, vendor web paths, or known camera manufacturers increases confidence.