DroneSploit – A pentesting console framework dedicated to drones (opens in new tab)

There are some cases of drone use in pentests that while less exciting than flying in vent pipes I still enjoyed. I had a pentest with a large cargo and shipping facility on the east coast and used off the shelf commodity equipment. We stripped hardware to the bare minimum in size to reduce weight, connected a cellular modem to a raspberry pi powered by battery and landed the drone on top of a building on the yard (that turned out to be a union break facility). The intention was to design it so that we would never recover it(granted it was authorized so we indeed recovered it). It gave us enough time to passively collect the data needed to breach the wifi in the break room / building, which in turn was hard lined into the main network.

All in I think the expenses were around $1200 total for the drone and this was like 8 years ago. Not something most would be willing to waste, but with time and effort you could make something now for probably a third the cost.

We also used a similar setup wired into a Jetski that we left attached to an adjacent dock once too. I can only imagine what others are doing ;D

Hack a drone to pentest with that same drone. Genius.

Me too

On older DJI Phantoms, you could connect to the Wifi hotspot and SSH into the drone. Not sure if that's still possible.

Yep, and not so much recent example : Tello, bebop... Those are quite old and well open to allow external control from custom softwares

Not many, but that's just PHY stuff. The threat model is really the barycenter of these targeted offensive security platforms. Adding support for new protocols is generally trivial if there's an option, and a place to leverage them will tend to incentivize development when there isn't.