# MQTT

> MQTT is a lightweight IoT messaging protocol. Attackers enumerate brokers and topics, probe for missing auth and plaintext transport, then exploit anonymous access to read or inject messages and harvest credentials

- **URL:** https://hackindex.io/services/mqtt
- **Type:** Service
- **Default ports:** 1883, 8883
- **Tags:** mqtt, iot, messaging, protocol, network, pub-sub
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe messaging protocol designed for IoT devices and constrained networks. It runs on **TCP 1883** for plaintext connections and **TCP 8883** for TLS-encrypted connections. Nmap identifies the service as `mqtt`.

MQTT brokers (such as Mosquitto, HiveMQ, and EMQ X) are increasingly found during engagements involving IoT, ICS/SCADA, and smart building environments. Many brokers allow anonymous connections by default, letting anyone subscribe to all topics using a wildcard (`#`). This exposes sensor data, device commands, credentials, and internal telemetry. Publishing to control topics can manipulate connected devices directly.

Enumeration starts with connecting anonymously and subscribing to the wildcard topic to observe all traffic. Topic naming conventions often reveal device types, locations, and organizational structure. Checking for the `$SYS` topic tree exposes broker statistics, version, and connected client information. Credential brute-forcing and testing for authorization bypass between topics are standard next steps.

## Phases

- [Enumeration](https://hackindex.io/services/mqtt/enumeration.md): Detect brokers, map topics, and extract broker system info (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/mqtt/vulnerability-discovery.md): Guides for finding MQTT auth flaws, weak creds, and plaintext transport (3 guides)
- [Exploitation](https://hackindex.io/services/mqtt/exploitation.md): Anonymous subscribe, unauthorized publish, retained message harvest guides (3 guides)
- [Data Exfiltration](https://hackindex.io/services/mqtt/data-exfiltration.md): Capture and exfiltrate MQTT topic payloads including credentials and teleme (1 guides)