用于MQTT渗透测试的Rust CLI：订阅/发布、broker指纹识别、ACL探测、主题枚举、凭据暴力破解，以及通过TLS/mTLS进行Last Will注入。
一个基于 Rust 的命令行 MQTT 渗透测试工具。
$ nix-shell
$ cargo build --release
二进制文件位于 target/release/mqattack。
需要 Rust 1.80+、C 编译器以及 OpenSSL 开发头文件。
$ cargo build --release
Nix 或 NixOS 用户可以使用现成的软件包。请注意，最新版本可能仅存在于 unstable 频道中。
$ nix-env -iA nixos.mqattack
所有命令共享一组通用的连接和认证选项：
Connection options:
-H, --host <HOST> Broker hostname or IP [default: localhost]
-p, --port <PORT> Broker port [default: 1883]
-u, --username <USER> Username
-P, --password <PASS> Password (mutually exclusive with --jwt)
--jwt <TOKEN> JWT token sent as MQTT password
--client-id <ID> MQTT client identifier [default: mqattack]
--keepalive <SECS> Keep-alive interval [default: 60]
TLS options:
--tls Enable TLS with system root CAs
--cafile <PATH> Custom CA certificate in PEM format (implies --tls)
--cert <PATH> Client certificate for mTLS in PEM format (requires --key)
--key <PATH> Client private key for mTLS in PEM format (requires --cert)
--insecure Disable certificate verification — for testing only
$ mqattack subscribe [OPTIONS] -t <TOPIC>...
-t, --topic <TOPIC> Topic filter, repeatable
-q, --qos <QOS> QoS level 0/1/2 [default: 0]
-C, --count <N> Exit after N messages
--hex Print payload as hexadecimal
# Subscribe to all topics
$ mqattack subscribe -t '#'
# Subscribe to multiple filters, exit after 5 messages
$ mqattack subscribe -t 'home/#' -t 'sensors/#' -C 5
# Plaintext with credentials
$ mqattack subscribe -H 192.168.1.10 -u admin -P secret -t '#'
# TLS using system root CAs (default port 8883)
$ mqattack subscribe --tls -H broker.example.com -p 8883 -t '#'
# TLS with a custom CA
$ mqattack subscribe --cafile ca.crt -H broker.example.com -p 8883 -t '#'
# mTLS with client certificate
$ mqattack subscribe --cert client.crt --key client.key --cafile ca.crt \
-H broker.example.com -p 8883 -t '#'
# JWT authentication over TLS
$ mqattack subscribe --tls --jwt 'eyJhbGci...' -H broker.example.com -p 8883 -t '#'
# Self-signed cert — skip verification
$ mqattack subscribe --insecure -H 192.168.1.10 -p 8883 -t '#'
# Collect for 5 seconds, print a grouped summary
$ mqattack sys-info -H 192.168.1.10
# Longer collection window
$ mqattack sys-info -H broker.example.com --tls -p 8883 -w 15
# Stream values live
$ mqattack sys-info -H 192.168.1.10 --live
$ mqattack publish [OPTIONS] -t <TOPIC> -m <MESSAGE>
-t, --topic <TOPIC> Target topic
-m, --message <MSG> Payload; use '-' to read from stdin
-q, --qos <QOS> QoS level 0/1/2 [default: 0]
-r, --retain Set the retain flag
# Publish a simple message
$ mqattack publish -t test/topic -m 'hello'
# Publish with QoS 1 and retain flag
$ mqattack publish -H 192.168.1.10 -t alerts/door -m 'open' -q 1 -r
# Pipe payload from stdin
$ echo '{"cmd":"reboot"}' | mqattack publish -t device/1/cmd -m -
# Publish over TLS with JWT
$ mqattack publish --tls --jwt 'eyJhbGci...' \
-H broker.example.com -p 8883 -t device/1/cmd -m 'reboot'
# mTLS publish
$ mqattack publish --cert client.crt --key client.key --cafile ca.crt \
-H broker.example.com -p 8883 -t test -m 'hello'
通过订阅 $SYS/# 并分析收集到的消息来识别 broker 软件及其版本。除标准的 SUBSCRIBE 外不会发送任何数据包——broker 通过其发布的内容暴露自身。
可识别的 broker 及其检测信号：
| Broker | 检测信号 |
|---|---|
| Mosquitto | $SYS/broker/version 值以 mosquitto version 开头 |
| HiveMQ | $SYS/broker/version 值以 HiveMQ 开头 |
| VerneMQ | $SYS/broker/version 值以 VerneMQ 开头 |
| EMQX | 主题位于 $SYS/brokers/（复数）下；从主题路径中提取节点名称 |
| NanoMQ | 主题位于 $SYS/nanomq/ 命名空间下 |
| RabbitMQ | $SYS/broker/version 值包含 rabbitmq |
当匹配到已知签名时，置信度报告为 high；当 $SYS/broker/version 存在但无法识别时报告为 low；当 $SYS 可访问但未产生任何识别信息时报告为 unknown。
$ mqattack fingerprint [OPTIONS]
-w, --wait <SECS> Collection window in seconds [default: 5]
--verbose Print all collected $SYS messages after the summary
示例
# Fingerprint a broker on the default port
$ mqattack fingerprint -H 192.168.1.10
# Longer collection window for slow brokers, then dump everything
$ mqattack fingerprint -H 192.168.1.10 -w 10 --verbose
# Fingerprint over TLS with credentials
$ mqattack fingerprint --cafile ca.crt -H broker.example.com -p 8883 \
-u admin -P secret
示例输出（Mosquitto）：
[+] Broker Fingerprint
Software: Mosquitto
Version: 2.0.18
Confidence: high
Build info: With OpenSSL 3.0.2 15 Mar 2022
Uptime: 12345 seconds
Clients connected: 3
Clients total: 47
Messages received: 1082
Messages sent: 2341
[*] 47 $SYS message(s) collected (use --verbose to see all)
探测单个主题或主题列表的订阅和/或发布权限。每次测试都会重新连接到 broker 并检查返回的 SubAck/PubAck。结果报告为 ALLOWED、DENIED、INCONCLUSIVE（未收到确认）或 SKIPPED。
注意： 发布探测需要 QoS 1 或 2（
-q 1或-q 2）才能获得 broker 确认。QoS 0 的发布探测始终返回INCONCLUSIVE。
$ mqattack check-acl [OPTIONS] (-t <TOPIC> | -w <FILE>)
-t, --topic <TOPIC> Single topic to probe (mutually exclusive with --wordlist)
-w, --wordlist <FILE> File with one topic per line (mutually exclusive with --topic)
--no-subscribe Skip subscribe permission tests
--no-publish Skip publish permission tests
--payload <TEXT> Payload used for publish probes [default: mqattack]
-q, --qos <QOS> QoS for publish probes (1 or 2) [default: 1]
--wait <SECS> Seconds to wait for a broker response per test [default: 5]
# Test a single topic (both subscribe and publish)
$ mqattack check-acl -H 192.168.1.10 -u admin -P secret -t 'home/lights/1'
# Test all topics from a wordlist, subscribe only
$ mqattack check-acl -H 192.168.1.10 -w topics.txt --no-publish
# Test publish permissions only with QoS 2
$ mqattack check-acl -H 192.168.1.10 -t 'cmd/device/1' --no-subscribe -q 2
# Check ACL over TLS with a custom CA
$ mqattack check-acl --cafile ca.crt -H broker.example.com -p 8883 -w topics.txt
# Use a custom payload and a longer wait window
$ mqattack check-acl -H 192.168.1.10 -t 'sensor/temp' --payload 'test' --wait 10
# Wordlist enumeration
mqattack enum-topics -H 192.168.1.10 -w mqtt-topics.txt
# Brute-force single-level topics under "home/"
mqattack enum-topics -H 192.168.1.10 --brute --prefix home --max-length 4
# Two-level brute-force (home/word/word) with longer window
mqattack enum-topics -H 192.168.1.10 --brute --prefix home --depth 2 -t 10
针对 broker 测试用户名/密码组合。支持四种攻击模式，均使用 broker 的 ConnAck 返回码来区分成功与失败（例如 BadUserNamePassword 与 NotAuthorized）。
| 模式 | 标志 | 使用场景 |
|---|---|---|
| 凭据对 | -c FILE | 测试预构建的 username:password 列表 |
| 单用户暴力破解 | -u USER -W FILE | 对单个账户进行字典攻击 |
| 密码喷洒 | -U FILE -P PASS | 使用单个密码尝试多个用户 |
| 交叉乘积 | -U FILE -W FILE | 所有组合（上限为 10 000，可用 --force 覆盖） |
--try-anonymous 会在任何词表尝试之前探测无凭据连接。
$ mqattack brute-auth [OPTIONS]