# MQTT Broker Information via $SYS Topics

- **URL:** https://hackindex.io/services/mqtt/enumeration/mqtt-broker-info
- **Path:** MQTT > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/mqtt/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

Most MQTT brokers publish internal statistics and configuration information under the `$SYS` topic hierarchy. These are read-only system topics that expose broker version, uptime, connected client list, message rates, and sometimes configuration details. Subscribing to `$SYS/#` pulls everything the broker publishes about itself without touching any application topics.

Not all brokers publish `$SYS` topics by default:

- Mosquitto publishes `$SYS` by default
- HiveMQ uses a different stats path (`$hivemq/#`)
- EMQX publishes under `$SYS/brokers/#`
- Some brokers disable system topics entirely

If `$SYS` returns nothing, proceed to topic discovery without this step.

## MQTT Broker Fingerprinting via $SYS Subscription

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/#' -v -C 50
# $SYS/broker/version mosquitto version 1.6.9
# $SYS/broker/uptime 382741 seconds
# $SYS/broker/clients/connected 14
# $SYS/broker/clients/total 47
# $SYS/broker/messages/received 1284930
# $SYS/broker/messages/sent 983421
# $SYS/broker/subscriptions/count 38
# $SYS/broker/load/messages/received/1min 42.35
# $SYS/broker/retained messages/count 23
```

Each topic reveals a different aspect of the broker state. Record all of them.

## Key $SYS Topics to Note

| Topic | What it reveals |
| --- | --- |
| `$SYS/broker/version` | Exact broker version: check against CVEs |
| `$SYS/broker/clients/connected` | Number of live clients |
| `$SYS/broker/clients/total` | Total clients ever connected |
| `$SYS/broker/retained messages/count` | How many retained messages exist: high count means more to harvest |
| `$SYS/broker/subscriptions/count` | Active subscriptions: indicates how many consumers are listening |
| `$SYS/broker/load/messages/received/1min` | Message rate: useful for timing passive collection |

A high `retained messages/count` value is particularly interesting: each retained message is a stored payload waiting to be read. Harvest them with [MQTT Retained Message Harvest](https://hackindex.io/services/mqtt/exploitation/mqtt-retained-message-harvest).

## Connected Client Information

Some brokers publish per-client information:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/broker/clients/#' -v -C 20
```

Mosquitto does not publish individual client IDs by default, but HiveMQ and EMQX expose more detail:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/monitor/#' -v -C 20
```

Client IDs often contain device names, serial numbers, or hostnames that reveal the environment topology.

## HiveMQ and EMQX Alternatives

HiveMQ publishes statistics under a different path:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$hivemq/#' -v -C 30
```

EMQX uses:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/brokers/#' -v -C 30
```

If the broker is identified from version strings in Nmap or CONNACK packets, target the appropriate path.

## Confirm Version Against Known CVEs

The version string from `$SYS/broker/version` goes straight to a CVE search. Mosquitto has had several notable vulnerabilities:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/broker/version' -C 1
```

Search the returned version against the NVD:

## References

- [Mosquitto: broker man page](https://mosquitto.org/man/mosquitto-8.html) - Full $SYS topic hierarchy documentation for Mosquitto
- [HiveMQ: broker statistics](https://www.hivemq.com/blog/mqtt-broker-statistics-monitoring-hivemq-mqtt-broker/) - HiveMQ-specific system topic paths for monitoring data