Incorrect route detected (// instead of /1) on Hipcams

[vende11s]

Description

I've noticed that many Hipcam devices that expose RTSP streams without any credentials typically use the route /1

When running Cameradar on these devices, it correctly detects the port and credentials (none in this case), but the discovered route ends up being // instead of /1. As a result, Cameradar reports a valid connection, but there’s actually nothing accessible at the // route

Steps to Reproduce

1. Scan a Hipcam device that uses the /1 route for RTSP (no credentials)
2. Observe that Cameradar identifies the correct port and authentication
3. Check the reported route - it appears as // instead of /1

Expected Behavior

Cameradar should detect and report the correct route /1 instead of //.

Additional Context

• The /1 route is present in default dictionary
• Might be an issue for more devices, but I've seen it happen only for Hipcams

[Ullaakut]

👋 Hi @vende11s thanks for opening this issue!

If Cameradar detects // as open, it likely means t hat the Hipcams incorrectly respond a 200 OK to probing at that path, when they have no stream exposed at that path.

• Did you check that there was absolutely no stream available at the // path?
• Can you tell me what model of Hipcam you are using? I'll look into their docs and try to figure out what firmware they use, it could be an implementation of RTSP that is not RFC-compliant
• Can you please paste the exact output you get from cameradar when running it in verbose mode?

Taking a quick look around, it seems that they use a custom implementation of the RTSP protocol that has been exploited before (https://github.com/MaximilianJungblut/Hipcam-RTSP-Format-Validation-Vulnerability), so it's likely that this is the reason and that Cameradar can't do anything about it, besides running it with a custom dictionary that omits // specifically for hipcam devices.