Default Webcam Username & Passwords

• ACTi: admin/123456 or Admin/123456
• Axis (traditional): root/pass,
• Axis (new): requires password creation during first login
• Cisco: No default password, requires creation during first login
• Grandstream: admin/admin
• IQinVision: root/system
• Mobotix: admin/meinsm
• Panasonic: admin/12345
• Samsung Electronics: root/root or admin/4321
• Samsung Techwin (old): admin/1111111
• Samsung Techwin (new): admin/4321
• Sony: admin/admin
• TRENDnet: admin/admin
• Toshiba: root/ikwd
• Vivotek: root/<blank>
• WebcamXP: admin/ <blank>

Search for Webcams on https://www.shodan.io/

• webcamxp country:US          
• WebcamXP city:"Chicago"
• webcam port:81
• webcam net:123.123.123.0/24    ---Filter by IP

How to fix Remote Desktop Connection Manager 2.7 full screen issue

I recently upgraded Remote Desktop Connection Manager (RDCMan) 2.2 to version 2.7. After I fixed the popup window issue (http://andyinmatrix.blogspot.ca/2015/07/how-to-fix-remote-desktop-connection.html), I encountered another even worse issue: the host’s screen doesn’t scale to fit the full size of the local client screen size, which the RDCMan version 2.2 is doing very well. I have to use scroll bars to get the “start” button. This is really annoyed.



A few steps to fix this problem:

Click menu “tool”-> “options”



Click tab “Client Area”. Make sure “Lock window size” is unchecked.



Right click the very top root level of the hosts tree (it is actually your .rdg file name), select “properties”



Click tab “Remote Desktop Settings”; uncheck "Inherit from parent"; check "Same as client area", click ok.



That’s all. Enjoy the full screen. And of course, don’t forget to save your .rdg file.

How to fix Remote Desktop Connection Manager 2.7 decrypt error pop up window issue

I recently upgraded Remote Desktop Connection Manager (RDCMan) 2.2 to version 2.7. When I open the .rdg file, I get this giant popup window:



Because the file has so many hosts with encrypted password, the size of the error window exceed the screen. I couldn’t even get to the “ok” button.
To fix this issue, we can remove the <password> </password> pair from the .rdg file.
1) You may want to backup it, actually you should make a copy before open the .rdg file with version 2.7.
2) Open the .rdg file with Notepad++. Press ctrl+h to open the “Replace” popup window.
---Find what:<password>.*</password>
---Replace with: null
---Search mode: Regular expression

3) Click “Replace All” button and save the file.
4) Open it with RDCMan 2.7. no popup window anymore.
However, you will have to re-enter your password for these hosts.

How to verify CVE-2013-3589 (Dell iDRAC 6 and iDRAC 7 XSS Vulnerability)

1.   Nessus description:

The remote Dell Remote Access Controller (iDRAC6 / iDRAC7) is affected by a cross-site scripting vulnerability. The login page does not properly sanitize user-supplied input to the 'ErrorMsg' parameter. An attacker could leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

2.   Demonstration:

1) Actually the login page does filter some Java scripts, so if you use the common script like <script>alert(1)</script>, it won’t work.
2) Example 1: pop up a javascript window.
https://192.168.xxx.xxx/login.html?ErrorMsg=%3Cimg%20src=asdf%20onerror=alert%28%22XSS%22%29%3E





3) Example 2: redirect to https://google.com

https://192.168.xxx.xxx/login.html?ErrorMsg="><img src=x onerror=window.open('https://google.com/');>

3.   Recommendation

1) Upgrade to firmware version 1.96 (iDRAC6) / 1.46.45 (iDRAC7) or later.

4.   References:

1). http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3589
2). http://www.tenable.com/plugins/index.php?view=single&id=70411