Inventorying Mosquitto MQTT brokers before testing topic authorization

A DEV Community article explains that a broker's external visibility can help start an inventory but cannot show which topics are readable or whether a device may publish commands. It notes that a ZoomEye query for the Mosquitto fingerprint returned about 1.18 million records, a broad count that does not reveal unique deployments or vulnerable devices. The author advises identifying every listener and its authentication, separating device, operator, and service identities, and checking the actual broker policy instead of assuming broad access. Testing is recommended on isolated brokers with non-production topics, verifying allow and deny results without publishing real control commands. The piece also highlights risks from bridges, retained messages, and last-will messages carrying state into later sessions.