mmainguy/cameras
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vrek: goal to research the cameras' own web interface

Browse Source 
- New goal: understand the Hikvision/Annke web UI and decide between
  embedding it and rebuilding its features natively.
- Issue for surveying forums and open-source clients, explicitly
  excluding firmware flashing, backdoors and auth bypasses.
- Finding: an activated Operator account reaches most of ISAPI; the
  alert stream needs more rights, main-stream stills are refused on both
  cameras, and the two cameras' account setups differ.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Michael Mainguy 2026-09-19 17:36:13 -05:00
parent 817310569d
commit e319b0198f
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
.vrek/log.ndjson
View File

@ -910,3 +910,15 @@
{"id":"evt-tzf54n4r5mav","type":"node.updated","subject":"iss-xmk9w3e","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"patch":{"attrs":{"revisit":"2026-09-27","deferred_because":"Nothing to check until today's clips pass the 7-day window on 2026-09-26; the user asked to check back in 8 days (2026-09-19)."}}},"at":"2026-09-19T22:19:23.949Z","parents":["evt-k2y32pmzgsav"],"hash":"1cbd9f706af6f551855d96434554a8398d7f507301b3e0bcd40249852c24bb86"}
{"id":"evt-ka14nmmw0r5k","type":"node.status_changed","subject":"iss-xmk9w3e","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"from":"open","to":"deferred"},"at":"2026-09-19T22:19:23.952Z","parents":["evt-tzf54n4r5mav"],"hash":"b314788a825399e06e4f501d945609763c0f3822cecf548e769635949ddcb39f"}
{"id":"evt-njvgvjp6ax6t","type":"node.status_changed","subject":"gol-sxakryh","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"from":"active","to":"retired"},"at":"2026-09-19T22:19:26.100Z","parents":["evt-ka14nmmw0r5k"],"hash":"edaf006242d2513feaf339710709c42081314e2b1e85c5f253f4fcfeaa6f837c"}
{"id":"evt-nhft0k949tqn","type":"node.created","subject":"gol-7ajfexk","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"goal","title":"Research the cameras' own Hikvision/Annke web interface and what it would take to use or replace it","body":"Understand what each camera's own web page offers and how it works, then decide between two routes (user's answer 2026-09-19: research both, recommend after). Route A, embed it: proxy or wrap the camera's web page inside this app so nobody has to leave it. Known obstacles: the cameras send X-Frame-Options: SAMEORIGIN, so today the app only links out in a new tab; the page has its own login, separate from ONVIF users (fnd-k1jyt83, fnd-3kp0rwy show ISAPI refusing the ONVIF Operator login for some endpoints); parts may need plugins or WebSocket streams; proxying someone else's app means rewriting URLs and carrying its session, and it would put a camera's admin surface behind our own session, which is a security decision in itself. Route B, learn from it: catalogue what the web page and ISAPI expose (settings we can't reach over ONVIF, events, SD-card playback, PTZ, firmware, user management) and record, feature by feature, what we could rebuild natively here. Output is evidence, not code: findings per feature with how it's reached, which login it needs and roughly what it would cost, plus a recommendation. Read-only against the user's own cameras; anything that would change a camera or add a second per-camera login needs the user's go-ahead first. Priority 1. Redaction of addresses and serials follows dec-kgm44qw.","status":"active","owner":null,"attrs":{},"weight":1,"target":null,"direction":"up","unit":null},"at":"2026-09-19T22:21:54.828Z","parents":["evt-njvgvjp6ax6t"],"hash":"47152d5dde06a5864aaeca9aa24f4d8c3f7924c7d8a12bc79cb324062097f87e"}
{"id":"evt-h6mj1v3hv46v","type":"edge.added","subject":"gol-7ajfexk","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"serves","from":"gol-7ajfexk","to":"gol-6q1q5mr"},"at":"2026-09-19T22:21:54.829Z","parents":["evt-nhft0k949tqn"],"hash":"6cc1ea35564f62dbc9e2b765d31ee616997766b4275e0ab13786b2d1ff8aeecc"}
{"id":"evt-fasqkg4wxjyb","type":"edge.added","subject":"gol-7ajfexk","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"upholds","from":"gol-7ajfexk","to":"pri-p9h51hx"},"at":"2026-09-19T22:21:54.830Z","parents":["evt-h6mj1v3hv46v"],"hash":"a6245da0084df156ca73fca91f89d3413ffc17f1ae56fb8c9265bc5fed140f29"}
{"id":"evt-26j6b8g7v7y8","type":"edge.added","subject":"gol-7ajfexk","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"upholds","from":"gol-7ajfexk","to":"pri-m1csgrm"},"at":"2026-09-19T22:21:54.831Z","parents":["evt-fasqkg4wxjyb"],"hash":"04a45db7c3ac4d477a02d37229ad1318d27744eebcf8c184be2e8b61e6fbe8cd"}
{"id":"evt-bxm1abqc01ft","type":"edge.added","subject":"gol-7ajfexk","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"upholds","from":"gol-7ajfexk","to":"pri-tyrxdz9"},"at":"2026-09-19T22:21:54.832Z","parents":["evt-26j6b8g7v7y8"],"hash":"92cb17aa2b59c4ae13f3a46d2a5636974e345bfdd75a8f2cb7c707f6625133c2"}
{"id":"evt-803bjn9bqfe6","type":"node.created","subject":"iss-6f346cm","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"issue","title":"Survey online sources and forums for deeper Hikvision/Annke integration without flashing","body":"Desk research, no camera access needed, for gol-7ajfexk. Find what other people have got working on stock firmware: which ISAPI endpoints exist beyond what the camera's own web page shows, which user level each needs (our Operator ONVIF login was refused by the picture endpoint with Device Busy and by alertStream with 403: fnd-k1jyt83, fnd-3kp0rwy), how the web page's own login and session work, whether live view and SD-card playback can be reached without plugins, what the event/alert feeds carry, and how Annke's OEM firmware differs from Hikvision's. Worth looking at: Hikvision's published ISAPI specifications, the IPCamTalk and Hikvision community forums, Home Assistant's integrations and their issue trackers, open-source clients (pyhik, hikvisionapi, python-hikvision, node clients), MediaMTX and go2rtc issues mentioning Hikvision, and ONVIF conformance notes. Out of scope, and not to be pursued: flashing or patching firmware, telnet or SSH backdoors, default or leaked credentials, authentication bypasses and known CVEs. Only documented or openly discussed interfaces on stock firmware, used with our own login. Record each useful thing as its own finding with its source, the date, which firmware it was seen on and how sure it looks; contradictory claims are common in forums, so mark what is confirmed versus reported.","status":"open","owner":null,"attrs":{}},"at":"2026-09-19T22:24:05.068Z","parents":["evt-bxm1abqc01ft"],"hash":"470f890960a9aee26231bf6ac73d2a3b88234db2d7772777c6d112dc543cb769"}
{"id":"evt-hfd5ezpc5mxm","type":"edge.added","subject":"iss-6f346cm","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"serves","from":"iss-6f346cm","to":"gol-7ajfexk"},"at":"2026-09-19T22:24:05.069Z","parents":["evt-803bjn9bqfe6"],"hash":"49a80ecbfe6b8abc6ec08147a1b29acd85907b3d4d1c10eb64f08ce31f911806"}
{"id":"evt-zbvncm69dec9","type":"edge.added","subject":"iss-6f346cm","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"tagged","from":"iss-6f346cm","to":"area:research"},"at":"2026-09-19T22:24:05.070Z","parents":["evt-hfd5ezpc5mxm"],"hash":"0d8922a9a8d8305d9310ed1ab3e936452b757d7e43c33f2375d386ba7bc40721"}
{"id":"evt-bkz4xcsdhpg3","type":"edge.added","subject":"iss-6f346cm","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"tagged","from":"iss-6f346cm","to":"area:device"},"at":"2026-09-19T22:24:05.071Z","parents":["evt-zbvncm69dec9"],"hash":"2351f1d644739699d3f13f014cc18599214b441a0c24c8cfff3961c529c189b6"}
{"id":"evt-cdb3qf9z1qq2","type":"node.created","subject":"fnd-5jk0ghz","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"finding","title":"ISAPI works with an activated Operator account, but the alert stream needs more rights and main-stream stills are refused on both cameras","body":"Tested on 2026-09-19 on camera …af2e with a purpose-made Operator account, created under the camera's own User Management and activated. Results: /ISAPI/System/deviceInfo 200; /ISAPI/System/capabilities 200 (12 KB); /ISAPI/Security/userCheck 200; /ISAPI/Streaming/channels/101/picture 503 \"Device Busy\"; /ISAPI/Event/notification/alertStream 403 Forbidden (statusCode 4). Two lessons. (1) 403 on alertStream is an authorization limit, not a login problem, so the alert stream needs a higher level than Operator on this firmware; ONVIF PullPoint already gives us motion with an Operator login (dec-d50j69a), so there is no reason to raise the level for that. (2) 503 on the main-stream still appears with every account tried, on both cameras, so it is a camera or firmware limit, confirming fnd-k1jyt83. Before activation the same account returned 401 everywhere: an account that has not been activated cannot authenticate at all, which is easy to mistake for a rights problem. Also: on camera …af54 the ONVIF user \"camera\" is accepted by ISAPI (deviceInfo 200), while on …af2e it is not, so accounts and their reach differ between two cameras of the same model; the ONVIF user list and the web user list are separate, and an entry in one does not imply the other. Capabilities advertised by …af2e: 91 isSupport flags, 46 true, including MotionDetection, TamperDetection, ROI, Snapshot, PanoramaCalibration, DeviceAudioCapture, VoiceTalkEvent, ConfigFileExport/Import, OnlineUpgradeTask, UsersPermissionConfig and ONVIFUserManagement; sections cover Audio, Device, Event, IO, Network, Racm (storage/playback), Security, Serial, Smart, Test, Video and WLAlarm. That document is the map for what ISAPI could add beyond ONVIF.","status":"current","owner":"prn-q80g8mz","attrs":{"sources":[{"url":"http://localhost/ISAPI/System/capabilities","note":"Cameras …af2e and …af54, addresses redacted per dec-kgm44qw; read-only curl with digest auth, no settings changed"}],"as_of":"2026-09-19"}},"at":"2026-09-19T22:32:38.646Z","parents":["evt-bkz4xcsdhpg3"],"hash":"b8fba9dcd5772018e4ad46e9f7f6ae167040a8113f6372d2009586b3f96c0925"}
{"id":"evt-zx81hkmwz8tw","type":"edge.added","subject":"fnd-5jk0ghz","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"informs","from":"fnd-5jk0ghz","to":"gol-7ajfexk"},"at":"2026-09-19T22:32:38.648Z","parents":["evt-cdb3qf9z1qq2"],"hash":"4e4b6e5e99bfc8e81e4a4410506702098ecf0a0ce5dd4c06324a84975e3a8a8a"}
{"id":"evt-vena3jmyy9t4","type":"edge.added","subject":"fnd-5jk0ghz","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"informs","from":"fnd-5jk0ghz","to":"iss-6f346cm"},"at":"2026-09-19T22:32:38.649Z","parents":["evt-zx81hkmwz8tw"],"hash":"d0c1d800b312001d80c2aca49ab1a6d902a5f752077a9310cd6c8d08b9317b8c"}