Unable to use custom routes

[elimerins]

Description

┌──(kali㉿kali)-[~]
└─$ cat routes3

onvif1

cmd and result

Cameradar version

version 6.1.1

Environment

ullaakut/cameradar docker image

Operating system

macos 15

Command

┌──(kali㉿kali)-[~]
└─$ sudo docker run --rm -v $(pwd)/my_creds2.json:/tmp/credentials.json -v $(pwd)/routes3:/tmp/routes ullaakut/cameradar -t pc_ip -c /tmp/credentials.json -r /tmp/routes --debug --ports 554

Output logs

2026-03-17T16:47:07Z [INFO] Startup: Running cameradar version 6.1.1, commit 2e83435
2026-03-17T16:47:07Z [INFO] Startup: targets: pc_ip
2026-03-17T16:47:07Z [INFO] Startup: ports: 554
2026-03-17T16:47:07Z [INFO] Startup: custom-routes: /tmp/routes
2026-03-17T16:47:07Z [INFO] Startup: custom-credentials: /tmp/credentials.json
2026-03-17T16:47:07Z [INFO] Startup: scanner: nmap
2026-03-17T16:47:07Z [INFO] Startup: scan-speed: 4
2026-03-17T16:47:07Z [INFO] Startup: skip-scan: false
2026-03-17T16:47:07Z [INFO] Startup: attack-interval: 0s
2026-03-17T16:47:07Z [INFO] Startup: timeout: 2s
2026-03-17T16:47:07Z [INFO] Startup: debug: true
2026-03-17T16:47:07Z [INFO] Startup: ui: plain
2026-03-17T16:47:07Z [INFO] Startup: output: disabled
2026-03-17T16:47:07Z [STEP] Scan targets: Scanning targets for RTSP streams
2026-03-17T16:49:48Z [INFO] Scan targets: Found 1 RTSP streams
2026-03-17T16:49:48Z [DONE] Scan targets: Scan complete
2026-03-17T16:49:48Z [STEP] Attack routes: Attacking RTSP routes
2026-03-17T16:49:49Z [DBUG] Attack routes: DESCRIBE rtsp://pc_ip:554/0x8b6c42 RTSP/1.0 > 401
2026-03-17T16:49:49Z [INFO] Attack routes: Default route accepted for pc_ip:554
2026-03-17T16:49:49Z [DONE] Attack routes: Finished route attacks
2026-03-17T16:49:49Z [STEP] Detect authentication: Detecting authentication methods
2026-03-17T16:49:50Z [DBUG] Detect authentication: DESCRIBE rtsp://pc_ip:554/ RTSP/1.0 > 401
2026-03-17T16:49:50Z [INFO] Detect authentication: Detected digest authentication for pc_ip:554
2026-03-17T16:49:50Z [DONE] Detect authentication: Authentication detection complete
2026-03-17T16:49:50Z [STEP] Attack credentials: Attacking credentials
2026-03-17T16:49:52Z [DBUG] Attack credentials: DESCRIBE rtsp://id:pw@pc_ip:554/ RTSP/1.0 > 200
2026-03-17T16:49:52Z [INFO] Attack credentials: Credentials found for pc_ip:554
2026-03-17T16:49:52Z [DONE] Attack credentials: Credential attacks complete
2026-03-17T16:49:52Z [STEP] Validate streams: Validating streams
2026-03-17T16:49:53Z [DBUG] Validate streams: DESCRIBE rtsp://id:pw@pc_ip:554/ RTSP/1.0 > 200
2026-03-17T16:49:53Z [DBUG] Validate streams: SETUP rtsp://id:pw@pc_ip:554/ RTSP/1.0 > 400
2026-03-17T16:49:53Z [DONE] Validate streams: Stream validation complete
2026-03-17T16:49:53Z [INFO] Attack routes: Re-attacking routes for partial results
2026-03-17T16:49:54Z [DBUG] Validate streams: DESCRIBE rtsp://id:pw@pc_ip:554/ RTSP/1.0 > 200
2026-03-17T16:49:55Z [DBUG] Validate streams: SETUP rtsp://id:pw@pc_ip:554/ RTSP/1.0 > 400
Summary

Accessible streams: 0
• None

how can i use custom-route?

this route i said is real-available route.

Expected behavior

results show 1 accessible streams

Additional Info

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[Ullaakut]

Hi @elimerins !

Since you removed the ID and password from your debug logs, I can't tell if these are the ones from the custom dictionary or not? The output looks fine to me, since the camera returned 200 OK responses to the attack requests, but it did respond with a 400 Bad Request to the validation request. It is likely that this model of camera does not accept the SETUP method for some reason? Could you tell me what type of camera this is? And confirm whether the credentials/route it tried are the ones you configured?

[elimerins]

The credentials I tried are custom credentials that I verified work correctly with vlc players etc. I only put 1 for quick testing.

However, I don't know if the routes were applied properly when customized.
Custom files are the same as the body.

Judging from the log, it seems to be looking for routing before credentials, is that correct?

sorry to mistake for closing this issue. it doesn't complete.

[Ullaakut]

Yes it is normal that we attack routes before credentials, since this is the order of operations that follows the RTSP RFC.

My questions were:

• In the logs, are the routes and credentials used the ones you specified in your custom dictionaries? We cannot tell because you censored the logs.
• What type of camera are you using? It seems that Cameradar did access your camera correctly, but the camera simply rejected the validation step which we use to ensure that it was accessed correctly.

[elimerins]

1. Yes, I am customizing both the credentials and the routes. The credentials only use a pair of ID passwords (actually valid) and one line of the routes. The original routes in the hub were also blank, so I entered the same line by line

2. iptime camera in use. EFM networks. Made in Korea.

[Ullaakut]

If the logs contain the custom routes and credentials you specified, I don't understand why your issue is titled "Unable to use custom routes" ? Did you just mean that using the custom dictionary, Cameradar failed to access your camera? That's what I am understanding here but it's still not 100% clear to me 😄

It looks like what you are accessing might be an NVR and not a camera directly, would that make sense? That might explain why the NVR does not accept the SETUP request. When I look up the device you specify, this is what comes up: https://www.genians.com/platform/EFM-Networks_ipTIME_BE19000_AP/?infokey=dWdbPIP9i8eMVm2ZsV7AbA%3D%3D

[elimerins]

I think I used the custom route correctly, but I was wondering if the program doesn't recognize it. Here are the paths that actually work on players that support rtsp.

rtsp://id:password@camera's ip/onvif1

when i use player(with rtsp func), use really working id,password,ip,route. :) that's purposely covered.

Accordingly, I put onvif1 in routes, but it didn't work.

I'm using iptime's c400g camera.

[Ullaakut]

Ah, I get it now, sorry I didn't realize from the logs that the target responded with 200 OK to the dummy route. So basically the way cameradar works, when it comes to routes, is it attempts to access a route at "/0x8b6c42" which obviously is not a real route. If the target responds with 200 OK, which yours did, we consider that the camera allows any route so we have no way to determine which routes are valid and which are not. This is because the device does not implement the RTSP protocol correctly, or is doing this specifically to make this kind of attack impossible.

Perhaps what could be done to make this case work, would be to allow passing the known routes to Cameradar, so that it only bruteforces credentials. But then this would be a feature request.

Thoughts @nblair2 @whiteboxsolutions ?