MQTT:

Enumeration

Detect brokers, map topics, and extract broker system info

3 guides • Created Mar 16, 2026 • Updated Mar 29, 2026

3 guides

MQTT Broker Information via $SYS Topics

Mar 16, 2026 • 3 min read

MQTT Service Detection and Version Identification

Mar 16, 2026 • 3 min read

MQTT Topic Discovery and Structure Mapping

Mar 16, 2026 • 3 min read

MQTT enumeration starts with broker discovery on the default ports (1883 for plaintext, 8883 for TLS) and identifying the broker software and version.

Subscribing to wildcard topics reveals the topic hierarchy and connected clients. QoS levels, retained messages, and client IDs give insight into the broker's configuration and the devices communicating through it.