Skip to content
HackIndex.io

AMQP Credential and Permission Testing

3 min read Created Feb 7, 2026 Last updated Feb 7, 2026

AMQP Permission Testing

AMQP credential testing confirms whether discovered credentials work at the protocol level and what permissions they carry. RabbitMQ permissions are three-dimensional: configure (create/delete resources), write (publish messages), and read (consume messages): each independently controlled per vhost. Test with amqp-tools which provides lightweight command-line AMQP clients. Default credentials to test first are covered in RabbitMQ default credential testing.

  • Install amqp-tools
  • Build the Broker URI
  • Validate Login Without Being Noisy
  • Test Read Permission on a Known Queue
  • Test Write Permission
  • Test Different Vhosts

Install amqp-tools

┌──(kali㉿kali)-[~]
└─$ apt-get install -y amqp-tools 2>/dev/null

Build the Broker URI

Use the full URI format so all parameters are explicit. The default vhost is / encoded as %2F:

┌──(kali㉿kali)-[~]
└─$ # Plaintext AMQP: default vhost
┌──(kali㉿kali)-[~]
└─$ export AMQP_URI="amqp://$USER:$PASSWORD@$TARGET_IP:5672/%2F"
 
┌──(kali㉿kali)-[~]
└─$ # Specific vhost
┌──(kali㉿kali)-[~]
└─$ export AMQP_URI="amqp://$USER:$PASSWORD@$TARGET_IP:5672/production"
 
┌──(kali㉿kali)-[~]
└─$ # TLS AMQPS
┌──(kali㉿kali)-[~]
└─$ export AMQP_URI="amqps://$USER:$PASSWORD@$TARGET_IP:5671/%2F"

Validate Login Without Being Noisy

Attempt to get from a non-existent queue: a connection error means auth failed, a queue error means auth succeeded:

┌──(kali㉿kali)-[~]
└─$ amqp-get --url="$AMQP_URI" --queue='__probe__' 2>&1 | head -3 
Error: NOT_FOUND - no queue '__probe__' in vhost '/'

NOT_FOUND on the queue means the connection and authentication succeeded: only the queue name is wrong. An ACCESS_REFUSED or LOGIN_REFUSED error means credentials or vhost are wrong.

┌──(kali㉿kali)-[~]
└─$ amqp-get --url="amqp://guest:wrongpass@$TARGET_IP:5672/%2F" --queue='__probe__' 2>&1 | head -2 
Error: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN.

Test Read Permission on a Known Queue

Pull a single message from a discovered queue to confirm read access:

┌──(kali㉿kali)-[~]
└─$ amqp-get --url="$AMQP_URI" --queue='task_queue' 2>&1 
{"task_id": "abc123", "user_id": 42, "action": "send_email", "token": "eyJhbGc..."}

Message content containing tokens, user IDs, and internal task data is immediately useful. Pull messages from all discovered queues and grep for credentials and tokens.

Note: amqp-get always removes the fetched message from the queue: there is no non-destructive read option. For a non-destructive read, use the RabbitMQ management API with ackmode=ack_requeue_true.

Test Write Permission

Publish a controlled marker message to confirm write access. Use a routing key that matches an existing queue if known:

┌──(kali㉿kali)-[~]
└─$ echo "pentest-probe-$(date +%s)" | amqp-publish --url="$AMQP_URI" --exchange='' --routing-key='task_queue' 2>&1

No error output means the publish succeeded: write access confirmed. Document the exact queue and exchange targeted. If publishing to a queue consumed by backend workers, you can influence application behavior: scope this carefully with engagement rules before going further.

Test Different Vhosts

When the default vhost has limited permissions, test each discovered vhost separately:

┌──(kali㉿kali)-[~]
└─$ for vhost in '%2F' production staging payments; do
result=$(amqp-get --url="amqp://$USER:$PASSWORD@$TARGET_IP:5672/$vhost" --queue='__probe__' 2>&1 | head -1)
echo "$vhost: $result"
done 
%2F: Error: NOT_FOUND - no queue '__probe__'
production: Error: NOT_FOUND - no queue '__probe__'
staging: Error: ACCESS_REFUSED - access to vhost 'staging' refused
payments: Error: NOT_FOUND - no queue '__probe__'

References