Teardown of a custom camera exploitation and viewing project (camview) found in an open directory

Found inside camview.tar.gz on an exposed server: a Docker project used to find, exploit, and stream internet-exposed IP cameras in a browser. The operator's own name for it, from the archive and README, is camview. It is not connected to any legitimate app of the same name. Built with FastAPI and Uvicorn, Python 3.11 image with FFmpeg, nmap, and masscan baked in FFmpeg transcodes the camera RTSP feed to MJPEG for display; nmap and masscan provide the initial scan layer The audit feature is where the exploitation happens: cameras are fingerprinted across a dozen-plus brands, queried over ONVIF, tested against known CVEs, then brute-forced over HTTP and RTSP with a 3,811-entry username:password dictionary Working credentials and stream URL patterns are written to disk and prioritized on later runs, so it improves per vendor The exploitation itself is not custom. camview wraps Ingram, a public webcam scanner, mounted in from the host On a second, unrelated directory, scripts named camworm.py and routerworm.py follow a compromise-then-proxy pattern and contain no actual worm functionality despite the naming We rebuilt the UI in a sealed test environment by running it with empty data. Full analysis in the post: submitted by /u/Straight-Practice-99 [link] [ ]