IP Camera Exposure Probe
For people who run IP cameras, NVRs or DVRs: enter a public host you own and this speaks RTSP, ONVIF and HTTP to it, then prints exactly what answered, from server headers and auth realms to ONVIF scopes, with an exposure rating.
For hosts you run or may test
Probes leave our server, so they see only what a public host shows the internet, never the network or room you are in.
Ports 554 · 3702 · 80, 8080, 8000
No host probed yet
Enter your public IP or the hostname a camera answers on, then press Probe. A silent host takes several seconds, because each probe waits out its timeout.
How the camera probe works
Your browser sends the host and ports to the pwnsy API at antispy.pwnsy.com, which resolves the host and runs three kinds of probe from its own server:
- RTSP OPTIONS over TCP. A camera replies with a
Serverheader, often the model. A401still confirms RTSP. - ONVIF WS-Discovery Probe over UDP. A match returns scopes such as
onvif://www.onvif.org/hardware/DS-2CD2042WD. Discovery is built for multicast and UDP is not retried, so a silent row rules out little: run it twice. - HTTP HEAD on each web port. Reads
Serverand theWWW-Authenticaterealm; never fetches a frame or logs in.
Only the listed ports are touched. A camera behind a relay, vendor cloud tunnel or CDN answers nothing here and is still there. A confirmed reply says nothing about where the lens points or who is watching. Requests follow RFC 2326 for RTSP and the ONVIF Device Discovery specification, which builds on WS-Discovery.
How to read the result
Confirmed
A real protocol reply came back. An RTSP server answered OPTIONS, ONVIF WS-Discovery returned a match, or an HTTP listener named itself. A 401 counts: refusing you is still answering you.
Inconclusive
The port answered without identifying itself, or stayed silent where silence proves nothing. That is what a camera behind a login looks like from outside, and also what a hundred other things look like.
Nothing there
Refused or dropped. The address is reachable and nothing responded on that port. On that port only; other ports and relays are still open questions.
Exposure rating. High: RTSP or ONVIF confirmed, the camera interface itself answers the internet. Medium: an HTTP listener confirmed or named a vendor, or a port answered and nothing in its reply marks it as a camera. Low: nothing answered on the ports checked, where a silent UDP probe counts as no answer. The rating covers these ports only.
When a vendor is hinted, the next-steps block links straight to that vendor's known-exploited flaws in the Camera CVE watch. A header can be edited or proxied, so treat a vendor hint as a lead.
Camera probe FAQ
Can the probe see cameras on my home network?
No. The probes leave the pwnsy server, so they reach public addresses only and see what a host shows the internet. They never see the network or room you are in.
Does the probe log in or pull video?
No. It sends an RTSP OPTIONS request, an ONVIF WS-Discovery probe and an HTTP HEAD request per web port. It reads headers, realms and scopes and never fetches a frame or logs in.
What does a 401 reply mean?
A 401 still confirms the service. Refusing you is still answering you, so an RTSP 401 means an RTSP server is listening on that port.
Why did ONVIF come back silent?
ONVIF discovery is built for multicast and runs over UDP, which the probe does not retry. A silent ONVIF row rules out little, so run the probe twice.
Which hosts may I probe?
Only hosts you run or have permission to test. Nmap publishes scanme.nmap.org for anyone to test against, which is why it is the sample.
Probes run live from the pwnsy API. Headers, realms and scopes are printed as the host returned them.