If you have ever stumbled down a late-night internet rabbit hole, you might have encountered the search query "inurl:viewerframe mode=motion." For years, this specific string of text has been famous in tech circles, hacker forums, and among the morbidly curious for allegedly unlocking a hidden world of unsecured, live security cameras from around the globe.
viewerframe implementations process the mode parameter without sanitization, leading to remote code execution (CVE-2018-10660-like vulnerabilities).Inurl: This parameter specifies that the search should only return URLs containing a particular string. In this case, “ViewerFrame?Mode=Motion.” inurl viewerframe mode motion
viewerframe: This part of the search term is looking for URLs that contain the word "viewerframe," which is commonly associated with IP camera software. Many IP cameras use web-based interfaces for remote viewing, and "viewerframe" is sometimes part of the URL or page name for accessing these interfaces. Inurl : This parameter specifies that the search
Add -site:example.com to filter out false positives.
Check results via Shodan (more reliable than Google for this purpose). and in some cases today
Despite the decline, Shodan (a search engine for internet-connected devices) still indexes thousands of devices with port:80 "viewerframe". Why?
If you were to perform this search (and we will discuss the ethics later), what kind of results would appear? Historically, and in some cases today, you might find: