Nmap rtsp-url-brute NSE Script

Script Overview

---

Script source code: https://github.com/nmap/nmap/tree/master/scripts/rtsp-url-brute.nse
Script categories: brute, intrusive
Target service / protocol: rtsp, tcp
Target network port(s): 554
List of CVEs: -

Script Description

---

The rtsp-url-brute.nse script attempts to enumerate RTSP media URLS by testing for common paths on devices such as surveillance IP cameras.

The script attempts to discover valid RTSP URLs by sending a DESCRIBE request for each URL in the dictionary. It then parses the response, based on which it determines whether the URL is valid or not.

Rtsp-url-brute NSE Script Arguments

---

This is a full list of arguments supported by the rtsp-url-brute.nse script:

rtsp-url-brute.threads

Sets the maximum number of parallel threads to run

rtsp-url-brute.urlfile

Sets an alternate URL dictionary file

- - -
To use these script arguments, add them to the Nmap command line using the --script-args arg1=value,[arg2=value,..] syntax. For example:

nmap --script=rtsp-url-brute --script-args rtsp-url-brute.threads=value,rtsp-url-brute.urlfile=value <target>

Rtsp-url-brute NSE Script Example Usage

---

Here's an example of how to use the rtsp-url-brute.nse script:

nmap --script rtsp-url-brute -p 554 <ip>

Rtsp-url-brute NSE Script Example Output

---

Here's a sample output from the rtsp-url-brute.nse script:

PORT    STATE SERVICE
554/tcp open  rtsp
| rtsp-url-brute:
|   discovered:
|     rtsp://camera.example.com/mpeg4
|   other responses:
|     401:
|_      rtsp://camera.example.com/live/mpeg4

Rtsp-url-brute NSE Script Example XML Output

---

Here's a sample XML output from the rtsp-url-brute.nse script produced by providing the -oX <file> Nmap option:

 <table key="discovered">
   <elem>rtsp://camera.example.com/mpeg4</elem>
 </table>
 <table key="other responses">
   <table key="401">
     <elem>rtsp://camera.example.com/live/mpeg4</elem>
   </table>
 </table>

Author

---

• Patrik Karlsson

References

---

• https://nmap.org/nsedoc/scripts/rtsp-url-brute.html
• https://github.com/nmap/nmap/tree/master/scripts/rtsp-url-brute.nse

See Also

---

Related NSE scripts to the rtsp-url-brute.nse script:

• rtsp-methods.nse

Visit Nmap NSE Library for more scripts.

The rtsp-url-brute.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.

ERROR: Connecting to RTSP server url: %s

---

Here is a relevant code snippet related to the "ERROR: Connecting to RTSP server url: %s" error message:

74:	local function fetch_url(host, port, url)
75:	  local helper = rtsp.Helper:new(host, port)
76:	  local status = helper:connect()
77:	
78:	  if not status then
79:	    stdnse.debug2("ERROR: Connecting to RTSP server url: %s", url)
80:	    return nil
81:	  end
82:	
83:	  local response
84:	  status, response = helper:describe(url)

ERROR: Sending DESCRIBE request to url: %s

---

Here is a relevant code snippet related to the "ERROR: Sending DESCRIBE request to url: %s" error message:

81:	  end
82:	
83:	  local response
84:	  status, response = helper:describe(url)
85:	  if not status then
86:	    stdnse.debug2("ERROR: Sending DESCRIBE request to url: %s", url)
87:	    return nil, response
88:	  end
89:	
90:	  helper:close()
91:	  return true, response

No dictionary could be loaded

---

Here is a relevant code snippet related to the "No dictionary could be loaded" error message:

123:	    nmap.fetchfile("nselib/data/rtsp-urls.txt")
124:	
125:	  threadcount = tonumber(threadcount)
126:	
127:	  if ( not(filename) ) then
128:	    return stdnse.format_output(false, "No dictionary could be loaded")
129:	  end
130:	
131:	  local f = io.open(filename)
132:	  if ( not(f) ) then
133:	    return stdnse.format_output(false, ("Failed to open dictionary file: %s"):format(filename))

Failed to open dictionary file: %s

---

Here is a relevant code snippet related to the "Failed to open dictionary file: %s" error message:

128:	    return stdnse.format_output(false, "No dictionary could be loaded")
129:	  end
130:	
131:	  local f = io.open(filename)
132:	  if ( not(f) ) then
133:	    return stdnse.format_output(false, ("Failed to open dictionary file: %s"):format(filename))
134:	  end
135:	
136:	  local url_iter = urlIterator(f)
137:	  if ( not(url_iter) ) then
138:	    return stdnse.format_output(false, ("Could not open the URL dictionary: %s"):format(f))

Could not open the URL dictionary: %s

---

Here is a relevant code snippet related to the "Could not open the URL dictionary: %s" error message:

133:	    return stdnse.format_output(false, ("Failed to open dictionary file: %s"):format(filename))
134:	  end
135:	
136:	  local url_iter = urlIterator(f)
137:	  if ( not(url_iter) ) then
138:	    return stdnse.format_output(false, ("Could not open the URL dictionary: %s"):format(f))
139:	  end
140:	
141:	  -- Try to see what a nonexistent URL looks like
142:	  local status, response = fetch_url(
143:	    host, port, ("rtsp://%s/%s"):format(