sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

Damn-Vulnerable-Drone

Damn Vulnerable Drone The Damn Vulnerable Drone is an intentionally vulnerable drone hacking simulator based on the popular ArduPilot/MAVLink architecture, providing a realistic environment for hands-on drone hacking. Table of Contents About the Damn Vulnerable Drone What is the Damn Vulnerable...

dronesploit

DroneSploit Easily pentest drones. This CLI framework is based on sploitkit and is an attempt to gather hacking techniques and exploits especially focused on drone hacking. For the ease of use, the interface has a layout that looks like Metasploit. pip3 install dronesploit ⚠️ When starting up the...

DroneCamera

DroneCamera An Android app for viewing the live video stream from HASAKEE FPV drones. Built by reverse engineering the proprietary UDP protocol used by the drone's WiFi camera. Supported Drone HASAKEE FPV Drone WiFi SSID: HASAKEE-WiFi-XXXXX VGA camera using the 0x6363 UDP protocol Drone IP:...

SymaX5SW-Rx-Tx

SymaX5SW Rx and Tx Research carried out on a SYMA X5SW Drone with three defined objectives. 1. Intercept the telemetry of the Drone and display it in a graphical interface in real-time. 2. Create a transmitter command control, using RF, Arduino modules and C code. 3. Intercept the video stream of...

skyjack

SkyJack SkyJack is a drone engineered to autonomously seek out, hack, and wirelessly take full control over any other drones within wireless or flying distance, creating an army of zombie drones under your control. Update: Proof of Concept of SkyJack for 3D Robotics drones using the TI CC1111...

PX4-Autopilot

The autopilot stack the industry builds on. About PX4 is an open-source autopilot stack for drones and unmanned vehicles. It supports multirotors, fixed-wing, VTOL, rovers, and many more experimental platforms from racing quads to industrial survey aircraft. It runs on NuttX, Linux, and macOS...

Dji_ble_vuln

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

infected-drones

Infected Drones Drone-to-Ground Control Station attack vectors, vulnerabilities & exploits Drone fleets today are one operator flying dozens or hundreds of drones from a single ground station. This makes the ground control station a valuable target for adversaries. It is where the pilot is usuall...

CVE-2026-77812

CVE-2026-77812 — DJI Drone Cleartext BLE Transmission of Wi-Fi PSK and Session UUID POC CVE record: https://vulners.com/cve/CVE-2026-77812 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77812 Description DJI Drone expose a DUML control channel over Bluetooth. Every message on that channel — in bo...

RSS-Based Verification of Drone Remote ID Position Claims with Unknown Transmit Power

Broadcast Remote Identification Remote ID is a key enabler for integrating unmanned aircraft into the airspace. However, the position it reports is self-declared and can be falsified with low-cost hardware. In this paper, we study how Remote ID receivers can verify the declared position from the...

Malware in @drone-js-ext/core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @drone-js-ext/vip-badge

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @drone-js-ext/vip-badge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @drone-js-ext/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @drone-js-ext/core (npm)

Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in cleartext to the hardcoded bare-IP endpoint...

Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...

MAL-2026-18276 Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...

Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...