# Nmap AMQP Fingerprinting (amqp-info)

- **URL:** https://hackindex.io/services/amqp/enumeration/nmap-amqp-fingerprinting-amqp-info
- **Path:** AMQP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/amqp/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-02-07

## Nmap amqp-info

AMQP fingerprinting extracts broker product, version, platform, authentication mechanisms, and capabilities from the connection handshake. RabbitMQ is by far the most common AMQP broker in pentest targets and exposes a management HTTP API on port 15672 that is the highest-value follow-on target. Port 5672 is plaintext AMQP and port 5671 is AMQP over TLS: both being open means plaintext is accepted alongside TLS, which is a misconfiguration finding.

- Service Detection: All AMQP and RabbitMQ Ports
- Pull Broker Properties
- TLS Certificate Check: Port 5671
- Erlang Port Mapper: epmd Enumeration

## Service Detection: All AMQP and RabbitMQ Ports

```bash
nmap -sV -p 5671,5672,15671,15672,25672,4369 $TARGET_IP
# 5672/tcp  open  amqp      RabbitMQ 3.11.4
# 15672/tcp open  http      Cowboy httpd
# 25672/tcp open  unknown
# 4369/tcp  open  epmd      Erlang Port Mapper Daemon
```

Port 15672 open confirms the RabbitMQ management plugin is active: this is the highest-priority follow-on target. Port 4369 is the Erlang Port Mapper Daemon (epmd), port 25672 is the Erlang distribution port used for clustering. Both being externally accessible is a misconfiguration.

## Pull Broker Properties

```bash
nmap -p 5672 $TARGET_IP --script amqp-info
# | amqp-info:
# |   capabilities:
# |     publisher_confirms: YES
# |     exchange_exchange_bindings: YES
# |     basic.nack: YES
# |     consumer_cancel_notify: YES
# |   copyright: Copyright (C) 2007-2023 VMware, Inc.
# |   information: Licensed under the MPL.
# |   platform: Erlang/OTP 25.1
# |   product: RabbitMQ
# |   version: 3.11.4
# |   mechanisms: PLAIN AMQPLAIN
# |_  locales: en_US
```

The `mechanisms` field shows `PLAIN` and `AMQPLAIN`: both transmit credentials in a weakly encoded form over the wire. On plaintext port 5672 this means credentials are visible to network interception. The version is the key output: cross-reference against known RabbitMQ CVEs and confirm whether the default `guest` account is still active.

## TLS Certificate Check: Port 5671

```bash
nmap -p 5671 $TARGET_IP --script ssl-cert,ssl-enum-ciphers
# | ssl-cert:
# |   subject: CN=rabbitmq.company.local
# |   Subject Alternative Name: DNS:rabbitmq.company.local, DNS:mq.internal.corp
# |_  Not valid after: 2027-01-01T00:00:00
```

Certificate SANs reveal internal hostnames. `mq.internal.corp` is a candidate for virtual host enumeration and DNS-based service discovery. Both 5671 and 5672 being open means the application stack accepts plaintext connections: any service using the plaintext port transmits credentials in the clear.

## Erlang Port Mapper: epmd Enumeration

epmd on port 4369 lists all Erlang nodes registered on the host. When accessible it reveals the RabbitMQ node name needed for cluster attacks:

```bash
nmap -p 4369 $TARGET_IP --script epmd-info
# | epmd-info:
# |   epmd_port: 4369
# |   nodes:
# |     rabbit: 25672
```

The node name `rabbit` at port 25672 confirms the RabbitMQ Erlang distribution port. Move to [RabbitMQ management port discovery](https://hackindex.io/services/amqp/enumeration/rabbitmq-management-port-discovery) and [default credential testing](https://hackindex.io/services/amqp/vulnerability-discovery/rabbitmq-default-credentials).

## References

- [nmap: amqp-info NSE](https://nmap.org/nsedoc/scripts/amqp-info.html) - Broker property and capability enumeration
- [RabbitMQ Networking](https://www.rabbitmq.com/docs/networking) - Default listener ports and related service reference