SCADA Hikvision ISAPI Enumeration

Enumerate Hikvision ISAPI (Intelligent Security Application Programming Interface) endpoints on industrial control and surveillance web interfaces. Hikvision devices and HikCentral Professional deployments expose a rich REST/XML API at predictable paths. While most endpoints require authentication (CAS session token, Basic auth, or Digest auth), unauthenticated enumeration reveals the device type, firmware baseline, available modules, and potential attack surface. JavaScript bundles often contain the full ISAPI route tree.

When to Use

• A web interface on a non-standard port (443, 8443, 9443) loads a large JavaScript bundle with references to /ISAPI/, Bumblebee, or Streaming/channels.
• Port scan reveals RTSP (554), ONVIF (8899), or Hikvision-specific ports (8000, 9010).
• The server header or SSL certificate references Hikvision, HikCentral, iVMS, or Pyramid.
• A target has industrial/energy/infrastructure context where SCADA systems are likely.
• The web client loads Common/common.js, Common/components.js, or Common/vendorGraph.js from a relative path.

Prerequisites

• terminal with curl, python3, and nmap.
• Access to the web interface (even without authentication).
• The target serves JavaScript bundles — download them for endpoint extraction.

Quick Detection