Hello,
I got a Niko camera which is based on the Hikvision platform (the QR code works perfectly with the Ezviz app). However, the RTSP server looks strange: there is an extra “custom” field in the WWW-Authenticate header:
WWW-Authenticate: Digest realm="00112a660cd0", nonce="ed3329d4f5200c61da3434dca54efffa", random="aOBvLunLxxtpwaO0NGJyNAE6FP0IIUoy/+Xj6UKzx2F30BY9za8VkgA+rxaulKx9", stale="FALSE"
I managed to write my own application as a proxy to modify the header and see the impact on the generated Authorization Digest, they are all used!
Has anyone seen this before?
I also tried the client to send me a “Basic” Authentication instead of “Digest”, and simply returned “admin:” in base64. So maybe the password is blank, or maybe they protect against this simple leak.
I give you my different test cases:
WWW-Authenticate: Digest realm="00112a660cd0", stale="FALSE"
=> error
=> simple realm digest isn't accepted
WWW-Authenticate: Digest realm="", nonce="", stale="FALSE"
=> Authorization: Digest username="admin", realm="", nonce="", uri="h264/ch1/main/av_stream", response="8c1449ff5a04a9aca295d3b6dcc70a47"
WWW-Authenticate: Digest realm="", nonce="", random="", stale="FALSE"
=> Authorization: Digest username="admin", realm="", nonce="", uri="h264/ch1/main/av_stream", response="8c1449ff5a04a9aca295d3b6dcc70a47"
=> if "custom" is not set, it considere as empty string
WWW-Authenticate: Digest realm="00112a660cd0", nonce="ed3329d4f5200c61da3434dca54efffa", random="aqqvLunLxxtpwaO0NGJyNAE6FP0IIUoy/+Xj6UKzx2F30BY9za8VkgA+rxaulKx9", stale="FALSE"
=> Authorization: Digest username="admin", realm="00112a660cd0", nonce="ed3329d4f5200c61da3434dca54efffa", uri="h264/ch1/main/av_stream", response="c65a32b8ab4f5e07f7a56560daa4d15a"
WWW-Authenticate: Digest realm="00112a660cd0", nonce="ed3329d4f5200c61da3434dca54efffa", random="aqqvLunLxxtpwaO0NGJyNAE6FP0IIUoy/+Xj6UKzx2F30BY9za8VkgA+rxaulKx9", stale="FALSE"
=> Authorization: Digest username="admin", realm="00112a660cd0", nonce="ed3329d4f5200c61da3434dca54efffa", uri="h264/ch1/main/av_stream", response="c65a32b8ab4f5e07f7a56560daa4d15a"
=> invalid base64 string in "custom" field is fine, so it's probably not decoded. But it generates different digest than otherwise
Thanks!!!