MQTT

Default Ports: 1883 (MQTT), 8883 (MQTT over TLS), 9001 (WebSocket)

MQTT is a lightweight publish/subscribe protocol used in IoT, telemetry, mobile apps, and microservices. In pentests, MQTT often exposes anonymous access, broad topic permissions, retained messages, and sensitive device or command traffic.

Connect

Using mosquitto_sub

mosquitto_sub validates read access to topics.

mosquitto_sub -h target.com -p 1883 -t 'test/topic'
mosquitto_sub -h target.com -p 1883 -t '#'
mosquitto_sub -h target.com -p 1883 -u username -P password -t '#'
mosquitto_sub -h target.com -p 1883 -v -t '#'

Using mosquitto_pub

mosquitto_pub validates write access with controlled messages.

mosquitto_pub -h target.com -p 1883 -t 'test/topic' -m 'hello'
mosquitto_pub -h target.com -p 1883 -u username -P password -t 'test/topic' -m 'hello'
mosquitto_pub -h target.com -p 1883 -t 'test/topic' -m 'retained-test' -r

Using TLS

TLS testing checks secure transport and certificate behavior.

mosquitto_sub -h target.com -p 8883 --capath /etc/ssl/certs -t '#'
mosquitto_sub -h target.com -p 8883 --insecure -t '#'
openssl s_client -connect target.com:8883 -showcerts

Using WebSocket MQTT

MQTT over WebSocket may be exposed by browser dashboards.

curl -i http://target.com:9001/mqtt
curl -i http://target.com:9001/ws

Recon

Service Detection with Nmap

Scan MQTT, TLS, WebSocket, and management ports.

nmap -p 1883,8883,9001 -sV target.com
nmap -p 8883 --script ssl-cert,ssl-enum-ciphers target.com
nmap -p 1883,8883 --open -sV 192.168.1.0/24

Broker Identification

Broker identity often comes from $SYS, TLS certificates, or management consoles.

openssl s_client -connect target.com:8883 -showcerts </dev/null
nmap -p 80,443,8080,8083,8084,18083,9001 -sV target.com
mosquitto_sub -h target.com -p 1883 -t '$SYS/#' -C 5 -W 5

Common Broker Ports

Scan vendor defaults when MQTT is suspected.

# Mosquitto: 1883, 8883
# EMQX: 1883, 8883, 8083, 8084, 18083
# HiveMQ: 1883, 8883, 8080
# VerneMQ: 1883, 8883, 8888

Enumeration

Anonymous Access

Anonymous subscribe or publish is the main MQTT finding.

mosquitto_sub -h target.com -p 1883 -t '$SYS/#' -v -W 10
mosquitto_sub -h target.com -p 1883 -t '#' -v -W 10
mosquitto_pub -h target.com -p 1883 -t 'pentest/check' -m 'anonymous-publish-test'

System Topics

$SYS topics may expose broker version, uptime, and client statistics.

mosquitto_sub -h target.com -p 1883 -t '$SYS/#' -v
mosquitto_sub -h target.com -p 1883 -u username -P password -t '$SYS/#' -v

Topic Discovery

MQTT has no standard topic listing, so wildcard subscriptions infer topic structure.

mosquitto_sub -h target.com -p 1883 -t '#' -v -W 30
mosquitto_sub -h target.com -p 1883 -t '+/+/+' -v -W 30

Retained Messages

Retained messages can expose the latest device state or commands.

mosquitto_sub -h target.com -p 1883 -t '#' -v --retained-only -W 10

ACL Enumeration

Compare topics across accounts to find overbroad permissions.

mosquitto_sub -h target.com -p 1883 -u device1 -P password -t '#' -v -W 10
mosquitto_pub -h target.com -p 1883 -u device1 -P password -t 'admin/command' -m 'test'

Attack Vectors

Anonymous Subscribe

Anonymous read access can expose telemetry and command topics.

mosquitto_sub -h target.com -p 1883 -t '#' -v

Anonymous Publish

Anonymous write access may alter device or application behavior.

mosquitto_pub -h target.com -p 1883 -t 'test/topic' -m 'pentest'

Wildcard Abuse

Broad wildcards can bypass weak topic design.

mosquitto_sub -h target.com -p 1883 -t '#' -v
mosquitto_sub -h target.com -p 1883 -t '+/command/#' -v

Weak Credentials

Device credentials are often reused or predictable.

hydra -L users.txt -P passwords.txt -s 1883 target.com mqtt
mosquitto_sub -h target.com -p 1883 -u username -P password -t '#'

Retained Message Poisoning

Retained publishes can leave persistent malicious or misleading values.

mosquitto_pub -h target.com -p 1883 -t 'test/topic' -m 'retained-pentest' -r
mosquitto_pub -h target.com -p 1883 -t 'test/topic' -n -r

WebSocket Exposure

Browser-accessible MQTT may expose tokens or weak CORS behavior.

curl -i -H 'Origin: https://attacker.example' http://target.com:9001/mqtt
rg -n 'mqtt|wss://|ws://|username|password|token' .

Post-Exploitation

Topic Mapping

Save observed topics and group them by device, tenant, or command path.

mosquitto_sub -h target.com -p 1883 -t '#' -v -W 60 > mqtt-topics.txt
cut -d' ' -f1 mqtt-topics.txt | sort -u

Sensitive Data Review

Search captured messages for secrets and identifiers.

grep -Ei 'password|secret|token|apikey|authorization|session|credential' mqtt-topics.txt
grep -Ei 'command|admin|config|ota|firmware|debug' mqtt-topics.txt

Logging Check

Generate controlled auth failures and publish attempts.

mosquitto_sub -h target.com -p 1883 -u invalid -P invalid -t '#' -W 3
mosquitto_pub -h target.com -p 1883 -t 'pentest/log-check' -m 'test'

Useful Tools

Tool	Purpose
mosquitto_sub	Subscribe and enumerate topics
mosquitto_pub	Publish test messages
nmap	Port scanning
openssl	TLS review
hydra	Credential testing
tcpdump	Traffic capture
MQTT Explorer	GUI topic browsing

Security Misconfigurations

Misconfiguration	Risk
Anonymous subscribe	Data exposure
Anonymous publish	Command injection or data tampering
Broad wildcard ACLs	Cross-tenant or cross-device access
Retained sensitive messages	Persistent data leakage
Weak device credentials	Broker compromise
Plaintext MQTT	Credential and message capture
WebSocket MQTT exposed	Browser-based abuse