Skip to content
HackIndex logo

HackIndex

MQTT Broker Information via $SYS Topics

3 min read Mar 16, 2026

Most MQTT brokers publish internal statistics and configuration information under the $SYS topic hierarchy. These are read-only system topics that expose broker version, uptime, connected client list, message rates, and sometimes configuration details. Subscribing to $SYS/# pulls everything the broker publishes about itself without touching any application topics.

Not all brokers publish $SYS topics by default — Mosquitto does, HiveMQ has a different stats path, and some brokers disable it. If $SYS returns nothing, proceed to topic discovery without this step.

Subscribe to All $SYS Topics

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/#' -v -C 50 
$SYS/broker/version mosquitto version 1.6.9
$SYS/broker/uptime 382741 seconds
$SYS/broker/clients/connected 14
$SYS/broker/clients/total 47
$SYS/broker/messages/received 1284930
$SYS/broker/messages/sent 983421
$SYS/broker/subscriptions/count 38
$SYS/broker/load/messages/received/1min 42.35
$SYS/broker/retained messages/count 23

Each topic reveals a different aspect of the broker state. Record all of them.

Key $SYS Topics to Note

Topic

What it reveals

$SYS/broker/version

Exact broker version — check against CVEs

$SYS/broker/clients/connected

Number of live clients

$SYS/broker/clients/total

Total clients ever connected

$SYS/broker/retained messages/count

How many retained messages exist — high count means more to harvest

$SYS/broker/subscriptions/count

Active subscriptions — indicates how many consumers are listening

$SYS/broker/load/messages/received/1min

Message rate — useful for timing passive collection

A high retained messages/count value is particularly interesting — each retained message is a stored payload waiting to be read. Harvest them with MQTT Retained Message Harvest.

Connected Client Information

Some brokers publish per-client information:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/broker/clients/#' -v -C 20

Mosquitto does not publish individual client IDs by default, but HiveMQ and EMQX expose more detail:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/monitor/#' -v -C 20

Client IDs often contain device names, serial numbers, or hostnames that reveal the environment topology.

HiveMQ and EMQX Alternatives

HiveMQ publishes statistics under a different path:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$hivemq/#' -v -C 30

EMQX uses:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/brokers/#' -v -C 30

If the broker is identified from version strings in Nmap or CONNACK packets, target the appropriate path.

Confirm Version Against Known CVEs

The version string from $SYS/broker/version goes straight to a CVE search. Mosquitto has had several notable vulnerabilities:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/broker/version' -C 1

Search the returned version against the NVD:

References