How thebadinteger/p2pwn works
p2pwn is a command-line Dahua camera security scanner. The main workflow parses serial numbers or prefixes, loads scan and method settings, checks device availability over P2P, establishes a tunnel, and attempts configured credential/CVE checks; successful results can include device details, snapshots, OSD changes, CSV records, and Dahua import XML. The graph uses README-described capabilities where source excerpts do not expose the complete wiring; uncertain call paths are not expanded into helper-level flows.
Main entry points: scanner.go Serial scanner · dhclient.go Device handshake · main.go CLI workflow · exploits.go CGI, SDK, CVE checks
Components 16
CLI and setup
- CLI workflow
main.go - Scan settings
core/config.go
Discovery and access
- Serial scanner
core/scanner.go - P2P availability
core/p2p/dhclient.go - P2P rendezvous
- Cloud profile
core/p2p/profile.go - Device handshake
core/p2p/dhclient.go - P2P tunnel
core/p2p/tunnel.go - P2P authentication
core/p2p/auth.go
Device operations
- CGI, SDK, CVE checks
core/exploits.go - SDK protocol
core/p2p/sdkbin.go - OSD overlay
core/osd.go
Results and output
- XML credentials
core/xml.go - Scan output
core/scanner.go - Output files
Other components
- Operator
Connections 20
- Operator → CLI workflow: provides targets
- CLI workflow → Scan settings: loads settings
- CLI workflow → Serial scanner: starts scan
- Serial scanner → P2P availability: checks serials
- P2P availability → Cloud profile: builds requests
- P2P availability → P2P rendezvous: contacts rendezvous
- Serial scanner → Device handshake: opens device session
- Device handshake → Cloud profile: uses profile
- Device handshake → P2P rendezvous: negotiates P2P
- Device handshake → P2P tunnel: establishes tunnel
- P2P tunnel → P2P authentication: uses credentials
- Serial scanner → CGI, SDK, CVE checks: runs configured checks
- CGI, SDK, CVE checks → P2P tunnel: sends device requests
- CGI, SDK, CVE checks → SDK protocol: tries SDK login
- Serial scanner → OSD overlay: applies overlay
- Serial scanner → SDK protocol: captures snapshot
- Serial scanner → XML credentials: encodes credentials
- Serial scanner → Scan output: records results
- Scan output → Output files: writes CSV and XML
- Scan output → Output files: saves snapshots