pentesting-rabbitmq

Test RabbitMQ default credentials by connecting with guest:guest using the Python amqp or pika library against port 5672. Although RabbitMQ restricts guest to localhost via loopback_users, many Docker and IoT images disable that check, so always attempt remote login rather than assuming it is blocked.

Sniff RabbitMQ messages by declaring a temporary exclusive queue and binding it to amq.topic with the '#' wildcard routing key using pika. This passively receives copies of live message bodies and headers without consuming or deleting messages from existing queues.

CVE-2024-51988 affects RabbitMQ versions up to 3.12.10, where the HTTP management API skips the configure permission check on queue deletions. A user with only read or write permissions can delete arbitrary queues via a DELETE request to /api/queues, causing denial of service.

Yes, RabbitMQ stream queues are append-only and retain messages after consumption. A read-only account can replay historical messages by consuming with the x-stream-offset argument set to first, potentially recovering old tokens, credentials, or PII.

RabbitMQ guest login fails remotely because the loopback_users configuration restricts the guest account to localhost connections by default. If remote guest access works, the target has disabled this protection, which is itself a reportable misconfiguration.

RabbitMQ testing should only occur during authorized engagements with explicit written permission. Active tests like queue deletion via CVE-2024-51988 and credential spraying are disruptive and can trigger account lockouts or data loss on production brokers.