How Hackers Locate Unsecured Network Cameras Using ZoomEye, Shodan, and IP Scanning

Introduction

Network cameras have been repeatedly exposed in privacy breaches, prompting interest in how attackers discover them. This article explains common methods used to locate unsecured cameras worldwide.

1. Discovering Cameras via Websites

ZoomEye

ZoomEye (Chinese name “钟馗之眼”) is a searchable database of internet‑connected devices. Users can enter keywords to find camera streams, then select a result to view the camera interface.

After searching, the results list devices; clicking a result opens the camera’s backend page where, with correct credentials, live video can be accessed.

Shodan

Shodan offers similar functionality but may be slower. Users must register to obtain an API key for programmatic access, such as Python scripts that query camera endpoints.

Example screenshots show search results and the process of selecting a camera entry.

2. Discovering Cameras via Software (IP Scanning)

Scanning IP ranges for open port 81 (common for cameras) can reveal devices. Ping sweeps identify live hosts, and the results are saved to a text file for further analysis with specialized software.

After importing the IP list into a camera analysis tool, users can open a camera’s web interface (e.g., a Hikvision device) to view the login page, which often reveals ASP‑based authentication mechanisms.

Conclusion

While the techniques described can be used for legitimate security research, they can also be abused to infringe on privacy. Ethical use and proper authorization are essential; the article does not provide detailed exploit code.