onvifscan

Included with Lifetime

$97 forever

ONVIF device security scanner for testing authentication and brute-forcing credentials. Use when you need to assess security of IP cameras or ONVIF-enabled devices.

Security

What this skill does


# Onvifscan - ONVIF Security Scanner

You are helping the user scan ONVIF devices for security issues including authentication bypasses and weak credentials using the onvifscan tool.

## Tool Overview

Onvifscan is an ONVIF device security scanner that can:
- Test for unauthenticated access to ONVIF endpoints
- Perform credential brute-forcing attacks

## Instructions

When the user asks to scan ONVIF devices, test IP cameras, or assess IoT device security:

1. **Determine scan type**:
   - `auth`: Authentication and access control testing (recommended to start)
   - `brute`: Credential brute-forcing on password-protected endpoints

2. **Get target information**:
   - Ask for the device URL/IP
   - Determine which scan type to run
   - Check if they have custom wordlists

3. **Execute the scan**:
   - Use the onvifscan command from the iothackbot bin directory
   - Format: `onvifscan <subcommand> <url> [options]`

## Subcommands

### Auth Scan
Tests ONVIF endpoints for authentication requirements:
```bash
onvifscan auth http://192.168.1.100
```

Options:
- `-v, --verbose`: Show full XML responses
- `-a, --all`: Test ALL endpoints including potentially destructive ones
- `--format text|json|quiet`: Output format

### Brute Force
Attempts credential brute-forcing on protected endpoints:
```bash
onvifscan brute http://192.168.1.100
```

Options:
- `--usernames <file>`: Custom usernames wordlist (default: built-in onvif-usernames.txt)
- `--passwords <file>`: Custom passwords wordlist (default: built-in onvif-passwords.txt)
- `--format text|json|quiet`: Output format

## Examples

Quick auth check on a device:
```bash
onvifscan auth 192.168.1.100
```

Auth check with verbose output:
```bash
onvifscan auth http://192.168.1.100:8080 -v
```

Brute force with custom wordlists:
```bash
onvifscan brute 192.168.1.100 --usernames custom-users.txt --passwords custom-pass.txt
```

## Important Notes

- URLs can omit `http://` - it will be added automatically
- Auth scan is non-destructive and safe to run
- Use `-a` flag with caution - may test destructive endpoints
- Brute force is rate-limited to prevent device overload (max 20 attempts by default)
- Built-in wordlists located in `wordlists/` directory

Files: 2

Size: 14.6 KB

Complexity: 19/100

Category: Security

Source: https://github.com/aiskillstore/marketplace/tree/main/skills/brownfinesecurity/onvifscan

Related in Security

mac-ops

Included

Comprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.

Securityscripts

a11y-audit

Included

Run accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).

Securityscripts

erpclaw

Included

AI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.

Securityscripts

assess

Included

Assesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.

Securityscripts

spring-boot-security-jwt

Included

Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.

Securityscripts

code-hardcode-audit

Included

Detect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.

Securityscripts

Detect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.

Securityscripts