ASEC
Closing the Exposure Window00
Research 02.09.2026 4 min read

Damn Vulnerable Drone: a whole aircraft you are allowed to break.

Open SourceUASTraining

The training range we build and maintain in the open — a simulated airframe, ground station, and radio link, free for anyone learning to attack autonomous systems.

The hardest part of learning to attack drones is not the technique. It is getting hold of something you are permitted to attack. Real airframes are expensive, and the interesting ones belong to somebody who will not enjoy the exercise. So most people never practise, and the skill stays rare.

Damn Vulnerable Drone is our answer. It is a deliberately insecure, fully simulated aerial vehicle — airframe, autopilot, companion computer, telemetry link, and ground control station — that you can stand up on a laptop and take apart without touching anything real or asking anyone for permission.

402GitHub stars, at the time of writing
00Dollars to run it
01Laptop required

Why we maintain it

It is the most honest advertisement we have. Everything in the lab is a class of weakness we have found in engagements: unauthenticated telemetry, a command path that trusts its own link, a ground station that assumes the aircraft on the other end is the one it was told about. The lab is where those live without an NDA attached.

  • Reconnaissance against a live simulated aircraft and its ground station.
  • Protocol work against the telemetry and command link.
  • Injection and takeover paths that mirror what production platforms still ship with.
  • A reset button, which is the part real hardware does not have.

Use it

It is free, it is open source, and it stays that way. If you teach this material, take it. If you are hiring for it, use it as the interview. If you find a gap in it, the issue tracker is open.

Same stack. Different aircraft.

If this reads like something in your programme, it probably is. Send us the architecture and we'll come back with a scope.

Talk to us

Research
08.10.2026

Infected Drones: when the aircraft attacks the ground station.

Six ground-control and middleware projects, fifteen findings, one broken trust boundary. A compromised drone does not have to stay on the vehicle — it can reach up the command chain and own the operator.

9 minRead →
Research
19.08.2026

MAVLink without a seatbelt.

A field study of telemetry links across eleven commercial aircraft, and what it takes to fly one from the ground.

12 minRead →
Research
22.07.2026

Signed, but not verified.

Four vendors shipped secure boot with signature checks that never ran. We show the extraction, the patch, and the fix.

14 minRead →