This is a simple string however you like to implement it's your choice depending on your server and settings. 

For the snapshot use the string 

http://ip of recorder/CGI-bin/snapshot.cgi? [channel=1]

Add your Ip to this and get the correct channel by adding the channel name withing the section [channel=1].

This will ask you for the password. If you want your user not to input the password add &authbasic=YWRtaW46YWRtaW4=

http://192.168.1.108/cgi-bin/snapshot.cgi? [channel=1]&authbasic=YWRtaW46YWRtaW4=

This uses base 64 authentication 

You can generate this if it's not set to default admin:admin which I would strongly recommend change upon first configuration.  

Use this decoder  add your username and password like this admin for the user and password lets say if you change it to 1234 then user admin:1234.

Which is YWRtaW46MTIzNA0K.

Keep in mind that if not coded correctly your base 64 string will be out in the open and anyone with access to a decoder can get your password. For this you can create a user that only has viewing access to the cameras that you want nothing more. You have been warned!.

I also have a stream article here. Take a gander at it. 
Enjoy!