AMQP

AMQP (Advanced Message Queuing Protocol) is an open messaging protocol commonly implemented by RabbitMQ, Apache Qpid, and other message brokers. The standard AMQP port is TCP 5672 for plaintext connections and TCP 5671 for TLS. RabbitMQ also exposes an HTTP management UI on TCP 15672. Nmap identifies the service as amqp.

Message brokers are attractive targets because they sit between application components and often carry sensitive data such as authentication tokens, job payloads, and internal API calls. Default credentials (guest:guest on RabbitMQ) are a frequent finding. When access controls are weak, an attacker can subscribe to queues, publish malicious messages, or extract credentials stored in broker configurations.

Enumeration typically starts with checking the management UI for unauthenticated access, then testing default or brute-forced credentials on both AMQP and the HTTP API. From there, listing exchanges, queues, bindings, and connected consumers reveals the internal messaging architecture and potential data exposure.