Skip to content
HackIndex.io

Nmap AMQP Fingerprinting (amqp-info)

3 min read Created Feb 7, 2026 Last updated Feb 7, 2026

Nmap amqp-info

AMQP fingerprinting extracts broker product, version, platform, authentication mechanisms, and capabilities from the connection handshake. RabbitMQ is by far the most common AMQP broker in pentest targets and exposes a management HTTP API on port 15672 that is the highest-value follow-on target. Port 5672 is plaintext AMQP and port 5671 is AMQP over TLS: both being open means plaintext is accepted alongside TLS, which is a misconfiguration finding.

  • Service Detection: All AMQP and RabbitMQ Ports
  • Pull Broker Properties
  • TLS Certificate Check: Port 5671
  • Erlang Port Mapper: epmd Enumeration

Service Detection: All AMQP and RabbitMQ Ports

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 5671,5672,15671,15672,25672,4369 $TARGET_IP 
5672/tcp  open  amqp      RabbitMQ 3.11.4
15672/tcp open  http      Cowboy httpd
25672/tcp open  unknown
4369/tcp  open  epmd      Erlang Port Mapper Daemon

Port 15672 open confirms the RabbitMQ management plugin is active: this is the highest-priority follow-on target. Port 4369 is the Erlang Port Mapper Daemon (epmd), port 25672 is the Erlang distribution port used for clustering. Both being externally accessible is a misconfiguration.

Pull Broker Properties

┌──(kali㉿kali)-[~]
└─$ nmap -p 5672 $TARGET_IP --script amqp-info 
| amqp-info:
|   capabilities:
|     publisher_confirms: YES
|     exchange_exchange_bindings: YES
|     basic.nack: YES
|     consumer_cancel_notify: YES
|   copyright: Copyright (C) 2007-2023 VMware, Inc.
|   information: Licensed under the MPL.
|   platform: Erlang/OTP 25.1
|   product: RabbitMQ
|   version: 3.11.4
|   mechanisms: PLAIN AMQPLAIN
|_  locales: en_US

The mechanisms field shows PLAIN and AMQPLAIN: both transmit credentials in a weakly encoded form over the wire. On plaintext port 5672 this means credentials are visible to network interception. The version is the key output: cross-reference against known RabbitMQ CVEs and confirm whether the default guest account is still active.

TLS Certificate Check: Port 5671

┌──(kali㉿kali)-[~]
└─$ nmap -p 5671 $TARGET_IP --script ssl-cert,ssl-enum-ciphers 
| ssl-cert:
|   subject: CN=rabbitmq.company.local
|   Subject Alternative Name: DNS:rabbitmq.company.local, DNS:mq.internal.corp
|_  Not valid after: 2027-01-01T00:00:00

Certificate SANs reveal internal hostnames. mq.internal.corp is a candidate for virtual host enumeration and DNS-based service discovery. Both 5671 and 5672 being open means the application stack accepts plaintext connections: any service using the plaintext port transmits credentials in the clear.

Erlang Port Mapper: epmd Enumeration

epmd on port 4369 lists all Erlang nodes registered on the host. When accessible it reveals the RabbitMQ node name needed for cluster attacks:

┌──(kali㉿kali)-[~]
└─$ nmap -p 4369 $TARGET_IP --script epmd-info 
| epmd-info:
|   epmd_port: 4369
|   nodes:
|     rabbit: 25672

The node name rabbit at port 25672 confirms the RabbitMQ Erlang distribution port. Move to RabbitMQ management port discovery and default credential testing.

References