What is this Google Dork?

The search string inurl:viewerframe mode motion network camera link is a specialized "Google Dork" used to find publicly accessible, often unsecured, IP security camera feeds.

5. Check Shodan.io

Cameras appearing in these search results are usually exposed due to: Geocamming — Unsecurity Cameras Revisited - Hackaday

2.1 The URL Structure

Deconstructing the String

: A parameter that instructs the camera to transmit video in "motion" mode—typically using Motion-JPEG (MJPEG) streaming to provide a live feed rather than a static image.

  1. Trendnet. (2012). TV-IP110 User Manual. Section 4.2: Web Viewer Interface.
  2. CVE-2018-10660 - Trendnet Camera Command Injection.
  3. OWASP. (2021). IoT Attack Surface Areas. URL manipulation.
  4. Shodan.io Report: "Most common URL patterns in exposed cameras", Q2 2023.
  5. Google Hacking Database (GHDB): Entry inurl:viewerframe?mode=.