Argos

Argos - framework for massive security assessment of worldwide public IP cameras

IMPORTANT:

This project is old and not actively mantained. The affected IP camera models have likely been patched or are no longer in use due to the age of these issues. This repository remains for educational purposes only.

Introduction

This project started as a simple testing script for the security assessment of Trendnet IP cameras, using Shodan as a source of potential targets.

Over time, it evolved into a flexible framework capable of detecting, assessing, and statistically monitoring IP cameras from various manufacturers around the world.

Argos relies on Shodan to discover devices of a specific model or manufacturer through a simple plugin system based on Bash scripts. These plugins define fingerprinting patterns used to identify devices.

Once targets are identified, Argos uses THC Hydra to test default credentials and parses the results. It can also attempt known exploits when available.

Scan results can be displayed on screen or sent automatically via email.

How It Works

The framework periodically queries the Shodan database (http://www.shodanhq.com) looking for devices that match predefined fingerprints.

This release includes three preconfigured scanners:

• Trendnet cameras (trendnet folder)
• Netwave cameras (netwave folder)
• D-Link cameras (dlink folder)

With a free Shodan API key, queries return up to 100 results — typically the most recent matching devices.

Argos processes these IPs by:

• Checking for vulnerabilities
• Testing default credentials

The number of vulnerable devices per scan may vary between 0 and 100.

After each scan, the framework waits for a configurable interval before querying Shodan again for new targets.

The process can be cleanly stopped using CTRL+C.

Requirements

• Python 2.6
  Expected at /usr/bin/python26
  Modify the first line of utils/shodanquery.py if needed

• A valid Shodan API key

  1. Register at Shodan
  2. Add your IP to the API whitelist
  3. Insert the key into utils/shodanquery.py

• Python Shodan module
  On Debian:

  apt-get install python-setuptools
  easy_install-2.6 shodan
  

• THC Hydra
  Installed and available in PATH

• Local mail server (e.g. Exim4)
  Must support local delivery

• Email configuration
  Set EMAILREPORTS in config file
  Example: username@localhost

• Mail client (optional)
  For local delivery, clients like Evolution can be used

Usage

Each scanner is independent and can be launched with:

./launch <plugin>

Available plugins:

• dlink
• trendnet
• netwave

Root privileges are not required.

Configuration

Basic configuration is located in the config file:

• sendemail (default TRUE)
• emailreports (destination email)

Understanding Results

Argos sends an email with results including entries like:

http://user:password@IP:PORT

Opening these links in a browser provides direct access to the device interface.

In most cases, authentication is handled automatically by the browser.

Some devices may require navigating within the interface before accessing protected areas.

In rare cases, credentials may need to be entered manually.

Note: This URL format does not work in Internet Explorer.

Developing New Scanners

Each scanner is based on the template folder and must define:

• A reliable fingerprint (Shodan query)
• A protected path requiring authentication
• Default credentials

Key variables in launch script:

• scannername
• fingerprint
• path_to_auth
• defaultlogin
• wordlistfile

Careful research is required to ensure accuracy and avoid false positives.

Notes

This project reflects practices and tooling from around 2016–2017 and is no longer actively maintained.

It is intended for educational and research purposes.

License

This project is licensed under the MIT License.