Skip to content
Security
Skill

/wsdiscovery

WS-Discovery protocol scanner for discovering and enumerating ONVIF cameras and IoT devices on the network. Use when you need to discover ONVIF devices, cameras, or WS-Discovery enabled equipment on a network.

From plugin
iothackbot
88513 skills

Claude Code

$ npx -y skills add brownfinesecurity/iothackbot --skill wsdiscovery --agent claude-code

SKILL.md

wsdiscovery.SKILL.md
name: wsdiscovery
description: WS-Discovery protocol scanner for discovering and enumerating ONVIF cameras and IoT devices on the network. Use when you need to discover ONVIF devices, cameras, or WS-Discovery enabled equipment on a network.

Wsdiscovery - WS-Discovery Protocol Scanner

You are helping the user discover and enumerate devices using the WS-Discovery protocol (commonly used by ONVIF cameras and IoT devices) using the wsdiscovery tool.

Tool Overview

Wsdiscovery implements the WS-Discovery protocol to discover network devices that support this standard. It's particularly useful for finding ONVIF cameras, network video recorders (NVRs), and other IoT devices that advertise themselves via WS-Discovery.

Instructions

When the user asks to discover ONVIF devices, find network cameras, or scan for WS-Discovery devices:

1. **Understand the target**:

  • Ask for the target hostname or IP address
  • Determine if they want verbose output (full XML responses)
  • Decide on output format

2. **Execute the scan**:

  • Use the wsdiscovery command from the iothackbot bin directory
  • Basic usage: `wsdiscovery <hostname_or_ip>`
  • For verbose output: `wsdiscovery <hostname_or_ip> -v`
  • For JSON output: `wsdiscovery <hostname_or_ip> --format json`

3. **Output formats**:

  • `--format text` (default): Human-readable colored output with device details
  • `--format json`: Machine-readable JSON
  • `--format quiet`: Minimal output

What It Discovers

The tool extracts and displays:

  • IP addresses and ports
  • Endpoint references (device UUIDs)
  • Device types
  • Manufacturer information
  • Device names and models
  • Hardware versions
  • Serial numbers
  • Firmware versions
  • Location information
  • Service endpoints (XAddrs) - URLs for device management
  • Metadata versions

Examples

Discover devices on a specific host:

wsdiscovery 192.168.1.100

Discover with full XML responses:

wsdiscovery 192.168.1.100 -v

Output device information as JSON:

wsdiscovery 192.168.1.100 --format json

Scan network broadcast address to find all devices:

wsdiscovery 239.255.255.250

Important Notes

  • WS-Discovery uses multicast/broadcast discovery
  • Devices must support the WS-Discovery protocol to be found
  • Common with ONVIF cameras, printers, and network media devices
  • Service endpoints (XAddrs) can be used with onvifscan for further testing
  • The tool parses ONVIF-specific scope information when available
Read more
@brownfinesecurity
Ships withiothackbot

Open-source IoT security testing toolkit with integrated Claude Code skills for automated vulnerability discovery.

Stars on GitHub

Momentum

stars in total
885
Star history of brownfinesecurity/iothackbot on GitHub, a chart by star-history.com

Other skills on iothackbot.

apktool

apktool

Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract…

chipsec

chipsec

Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and…

ffind

ffind

Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems.…

iotnet

iotnet

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use…

jadx

jadx

Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze…

jtagprobe

jtagprobe

Probe IoT/embedded targets for exposed SWD/JTAG debug interfaces using a SEGGER J-Link. Detects whether debug is OPEN, LOCKED…

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw12d23k
@nvidia@nvidiaInstall Skill

Questions about wsdiscovery.

Which coding agents can use wsdiscovery?
wsdiscovery installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.