Access to the screenshot without login and password?

[H@MST3R]

Hi,

My camera: Hikvision DS-2CD2T55FWD-I5
Firmware: V5.5.61 build 180718

When i uselink format "http://login:password@IP:PORT/ISAPI/streaming/channels/101/picture" works fine:
... but I need to configure the camera (or other link format) to skip the login process.
There is a possibility in this camera?

 

[StewartM]

I'm not aware of a way to bypass the login, but you could base64 encode the userassword and amend it to the end of the link:
http://IP:PORT/ISAPI/streaming/channels/101/picture?auth=YWRtaW46MTIzNDU=
The "?auth=YWRtaW46MTIzNDU=" is the encoded string for user:admin with password:12345
This should automate the login. Not 100% sure this is what you are aiming for, but hopefully it's a lead.

 

[H@MST3R]

Thank you Steward for a great way, but it doesn't work.
... still requesting login and password

 

[TonyR]

Thank you Steward for a great way, but it doesn't work.
... still requesting login and password

Many IP cams have in their settings, under "users", a checkbox for "anonymous user" so that login credentials are not required but I would not recommend it unless you can limit the cam to LAN access only.

 

[H@MST3R]

Now, the current Hikvision software does't have this option implemented

 

[StewartM]

I managed to automate the login with a tweak to Firefox.
Try this in Firefox:
1. Type about:config in the address bar and press Enter.
2. Click "I accept the risk!" warning.
2. Right-click in the empty space and select New>Integer.
3. Enter the preference name as: network.http.phishy-userpass-length and 254 as the integer value.

Paste your amended link in the address bar:
http://admin:12345@192.168.1.64/ISAPI/streaming/channels/101/picture

This works for me. Not sure if this is possible with Chrome.
This tweak potentially opens up a phishing security risk. For example, if your default browser is Firefox and you click a phishing link, it probably won’t prompt you to confirm the action. Some due-diligence is required.
Keep us posted.

 

[StewartM]

Forgot to mention, if you need to remove the setting right-click it and select reset. Close and re-open FF to complete the removal.

 

[H@MST3R]

This is a great bypass of the problem, but it doesn't solve it because the script from the website is run in different browsers.
The camera is used as a METEO weather station camera. I want to connect it to a script-based website from Weather34 Meteobridge MB SMART weather station template
This script needs an unauthorized image in camera.

 

[StewartM]

Ah, good to know.
In my testing with Hikvision (recent firmware) no anonymous/accounts with blank passwords are allowed. "<subStatusCode>riskPassword</subStatusCode>" is returned when trying to workaround it. The multiple browser aspect is another hurdle.

Overly complicated suggestion - You could setup a web server, create a web page that uses the WebSDK from Hikvision that fetches an image every X seconds or the live stream.
From there you could point METEO to the web server URL instead of the camera for the image using some JavaScript. Again, I'm clutching at straws here.

You could drop Hikvision for Vivotek cameras if you get fed-up, They allow anonymous login

 

[TonyR]

Overly complicated suggestion - You could setup a web server, create a web page that uses the WebSDK from Hikvision that fetches an image every X seconds or the live stream.
From there you could point METEO to the web server URL instead of the camera for the image using some JavaScript. Again, I'm clutching at straws here.

Pretty close to what I was thinking as well: have the cam FTP an image to a folder on a web site every so often, embed that <IMG SRC> with URL in the web page or have the METEO site fetch it.

You could drop Hikvision for Vivotek cameras if you get fed-up, They allow anonymous login

I have a couple of Amcrests (re-branded Dahuas) that do also, so perhaps Dahua does, too.