Skip to content
HackIndex logo

HackIndex

MQTT Topic Discovery and Structure Mapping

3 min read Mar 16, 2026

MQTT topics are hierarchical strings that publishers and subscribers use to route messages — for example factory/line1/sensor/temperature or home/bedroom/light/state. The topic structure reveals what devices are connected, what data they produce, and what control channels exist. Subscribing to wildcard patterns captures everything the broker is willing to show you.

This page assumes you can connect to the broker. If authentication is required, confirm credentials first.

Subscribe to All Topics

The # wildcard matches all topics at all levels. This is the first subscription to try:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v

-v prints the topic name alongside the payload. Let this run for at least 30 seconds — IoT devices often publish on slow intervals (sensor readings every 30s or 60s are common).

home/thermostat/temperature 22.5
home/doorbell/state pressed
factory/pump/rpm 1450
factory/pump/control {"cmd":"stop"}
credentials/backup admin:mqtt2024

Every line is a live message. The topic path tells you the device hierarchy. Payloads reveal data format — JSON, plain text, binary.

Subscribe to Retained Messages Only

Retained messages are stored on the broker and delivered immediately to any new subscriber. They often contain the last known state of every device — useful for a fast snapshot without waiting for live traffic:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --retained-only -C 100

--retained-only exits after receiving retained messages. -C 100 stops after 100 messages. Adjust the count based on how many topics you expect.

Wildcard Enumeration by Level

If # is ACL-restricted, try single-level wildcards to map the top-level namespace first:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '+' -v -C 20
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '+/+' -v -C 50
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '+/+/+' -v -C 50

+ matches exactly one level. Incrementing the depth reveals nested topic structures that a flat # subscription might not expose when partial ACLs are in place.

Targeted Topic Subscriptions

Once you have a partial picture of the namespace from wildcard results, target specific paths of interest:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'credentials/#' -v
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'config/#' -v
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'admin/#' -v
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'device/#' -v
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'cmd/#' -v
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t 'control/#' -v

Topics named cmd, control, set, or command are write paths — these are the targets for Unauthorized MQTT Publish.

Log All Traffic to File

For longer passive observation, log everything with timestamps:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --line-buffered | while read line; do echo "$(date -u +%H:%M:%S) $line"; done | tee /tmp/mqtt-traffic.txt

Review the log for patterns: repeated credential strings, device identifiers, control commands, JSON config payloads.

Map the Topic Tree

After collecting traffic, extract the unique topic paths to understand the full structure:

┌──(kali㉿kali)-[~]
└─$ awk '{print $1}' /tmp/mqtt-traffic.txt | sort -u

Group by top-level prefix to identify device categories, then map which topics receive writes versus reads to identify control channels.

References