# AMQP Credential and Permission Testing

- **URL:** https://hackindex.io/services/amqp/enumeration/amqp-credential-and-permission-testing
- **Path:** AMQP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/amqp/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-02-07

## AMQP Permission Testing

AMQP credential testing confirms whether discovered credentials work at the protocol level and what permissions they carry. RabbitMQ permissions are three-dimensional: configure (create/delete resources), write (publish messages), and read (consume messages): each independently controlled per vhost. Test with amqp-tools which provides lightweight command-line AMQP clients. Default credentials to test first are covered in [RabbitMQ default credential testing](https://hackindex.io/services/amqp/vulnerability-discovery/rabbitmq-default-credentials).

- Install amqp-tools
- Build the Broker URI
- Validate Login Without Being Noisy
- Test Read Permission on a Known Queue
- Test Write Permission
- Test Different Vhosts

## Install amqp-tools

```bash
apt-get install -y amqp-tools 2>/dev/null
```

## Build the Broker URI

Use the full URI format so all parameters are explicit. The default vhost is `/` encoded as `%2F`:

```bash
# Plaintext AMQP: default vhost
export AMQP_URI="amqp://$USER:$PASSWORD@$TARGET_IP:5672/%2F"

# Specific vhost
export AMQP_URI="amqp://$USER:$PASSWORD@$TARGET_IP:5672/production"

# TLS AMQPS
export AMQP_URI="amqps://$USER:$PASSWORD@$TARGET_IP:5671/%2F"
```

## Validate Login Without Being Noisy

Attempt to get from a non-existent queue: a connection error means auth failed, a queue error means auth succeeded:

```bash
amqp-get --url="$AMQP_URI" --queue='__probe__' 2>&1 | head -3
# Error: NOT_FOUND - no queue '__probe__' in vhost '/'
```

`NOT_FOUND` on the queue means the connection and authentication succeeded: only the queue name is wrong. An `ACCESS_REFUSED` or `LOGIN_REFUSED` error means credentials or vhost are wrong.

```bash
amqp-get --url="amqp://guest:wrongpass@$TARGET_IP:5672/%2F" --queue='__probe__' 2>&1 | head -2
# Error: ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN.
```

## Test Read Permission on a Known Queue

Pull a single message from a discovered queue to confirm read access:

```bash
amqp-get --url="$AMQP_URI" --queue='task_queue' 2>&1
# {"task_id": "abc123", "user_id": 42, "action": "send_email", "token": "eyJhbGc..."}
```

Message content containing tokens, user IDs, and internal task data is immediately useful. Pull messages from all discovered queues and grep for credentials and tokens.

**Note:** amqp-get always removes the fetched message from the queue: there is no non-destructive read option. For a non-destructive read, use the RabbitMQ management API with `ackmode=ack_requeue_true`.

## Test Write Permission

Publish a controlled marker message to confirm write access. Use a routing key that matches an existing queue if known:

```bash
echo "pentest-probe-$(date +%s)" | amqp-publish --url="$AMQP_URI" --exchange='' --routing-key='task_queue' 2>&1
```

No error output means the publish succeeded: write access confirmed. Document the exact queue and exchange targeted. If publishing to a queue consumed by backend workers, you can influence application behavior: scope this carefully with engagement rules before going further.

## Test Different Vhosts

When the default vhost has limited permissions, test each discovered vhost separately:

```bash
for vhost in '%2F' production staging payments; do
  result=$(amqp-get --url="amqp://$USER:$PASSWORD@$TARGET_IP:5672/$vhost" --queue='__probe__' 2>&1 | head -1)
  echo "$vhost: $result"
done
# %2F: Error: NOT_FOUND - no queue '__probe__'
# production: Error: NOT_FOUND - no queue '__probe__'
# staging: Error: ACCESS_REFUSED - access to vhost 'staging' refused
# payments: Error: NOT_FOUND - no queue '__probe__'
```

## References

- [RabbitMQ URI Specification](https://www.rabbitmq.com/docs/uri-spec) - AMQP URI format and vhost encoding reference
- [amqp-tools manpages](https://manpages.debian.org/testing/amqp-tools/) - amqp-get and amqp-publish options and behavior