I am about to set up an MQTT network at home. I want to build up some knowledge by practical exercises. It would be a small network with the broker hosted on my laptop (Windows 7) and some Raspberry Pi powered client. Also I am thinking about making a client on my phone (Android).
My goal is to have a simple network on which I can experiment and I want to perform some security testing, experimenting first.
I have found an MQTT Server Test Suite which is designed to act as a malicious MQTT client. It is pretty promising to start with.
Test tool general features
- Fully automated black-box negative testing
- Ready-made test cases
- Written in Java(tm)
- GUI, command line, remote interface modes
- Instrumentation (health-check) capability
- Support and maintenance
- Comprehensive user documentation
- Results reporting and analysis
But also I am interested in some more simple practices I can use to verify MQTT security features. What are the simplest ways for a beginner to perform some basic security verifications on an MQTT network?