onvifscanlisted

# Onvifscan - ONVIF Security Scanner You are helping the user scan ONVIF devices for security issues including authentication bypasses and weak credentials using the onvifscan tool. ## Tool Overview Onvifscan is an ONVIF device security scanner that can: - Test for unauthenticated access to ONVIF endpoints - Perform credential brute-forcing attacks ## Instructions When the user asks to scan ONVIF devices, test IP cameras, or assess IoT device security: 1. **Determine scan type**: - `auth`: Authentication and access control testing (recommended to start) - `brute`: Credential brute-forcing on password-protected endpoints 2. **Get target information**: - Ask for the device URL/IP - Determine which scan type to run - Check if they have custom wordlists 3. **Execute the scan**: - Use the onvifscan command from the iothackbot bin directory - Format: `onvifscan <subcommand> <url> [options]` ## Subcommands ### Auth Scan Tests ONVIF endpoints for authentication requirements: ```bash onvifscan auth http://192.168.1.100 ``` Options: - `-v, --verbose`: Show full XML responses - `-a, --all`: Test ALL endpoints including potentially destructive ones - `--format text|json|quiet`: Output format ### Brute Force Attempts credential brute-forcing on protected endpoints: ```bash onvifscan brute http://192.168.1.100 ``` Options: - `--usernames <file>`: Custom usernames wordlist (default: built-in onvif-usernames.txt) - `--passwords <file>`: Custom passwords word