# Enumeration

> Detect brokers, map topics, and extract broker system info

- **URL:** https://hackindex.io/services/mqtt/enumeration
- **Service:** [MQTT](https://hackindex.io/services/mqtt.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-29

MQTT enumeration starts with broker discovery on the default ports (1883 for plaintext, 8883 for TLS) and identifying the broker software and version.

Subscribing to wildcard topics reveals the topic hierarchy and connected clients. QoS levels, retained messages, and client IDs give insight into the broker's configuration and the devices communicating through it.

## Guides

- [MQTT Broker Information via $SYS Topics](https://hackindex.io/services/mqtt/enumeration/mqtt-broker-info.md)
- [MQTT Service Detection and Version Identification](https://hackindex.io/services/mqtt/enumeration/mqtt-service-detection-and-version-identification.md)
- [MQTT Topic Discovery and Structure Mapping](https://hackindex.io/services/mqtt/enumeration/mqtt-topic-discovery.md)