From the Hacker Desk

Case Study 6 January 2026

Drone-to-Network Pivot — Landing Inside the Firewall

In the twenty-fifth instalment of From the Hacker Desk — and the fifth in our drone security series — Hedgehog Security demonstrates how a drone configured to automatically sync captured imagery to a corporate server became a network bridgehead. Once connected to the corporate Wi-Fi for file upload, the compromised drone inherited internal trust, bypassed perimeter controls, and provided a pivot point into internal systems. The article examines insecure device onboarding, poor NAC enforcement, and the segmentation failures that allowed an airborne device to become an inside threat.

penetration-testing uav-security network-pivot

Case Study 2 December 2025

Cracking the Drone Controller — When Firmware Becomes the Weak Link

In the twenty-fourth and final instalment of the drone series within From the Hacker Desk, Hedgehog Security shifts focus from the aircraft to the handheld controller. Through firmware extraction and reverse engineering, we identified hard-coded credentials, an unencrypted firmware update channel, and authentication tokens that could be used to impersonate the controller to the manufacturer's cloud infrastructure. The article details firmware extraction methodology, update integrity validation failures, and the supply chain risks inherent in consumer and commercial UAV ecosystems.

penetration-testing firmware-analysis reverse-engineering

Case Study 4 November 2025

Exploiting GPS Spoofing Against a Security Patrol Drone

In the twenty-third instalment of From the Hacker Desk, Hedgehog Security demonstrates how GPS spoofing techniques could alter the flight path of an autonomous security patrol drone without physical or network access to the aircraft. The article explains the mechanics of civilian GNSS signal manipulation, the limitations of satellite navigation without integrity checking, and why organisations that rely on autonomous UAV patrols for perimeter security must understand the exploitable assumptions built into civilian GPS.

penetration-testing gps-spoofing drone-security

Case Study 7 October 2025

Turning a Corporate Drone into an Airborne Reconnaissance Platform

In the twenty-second instalment of From the Hacker Desk, Hedgehog Security examines how a corporate drone deployed for marketing footage had inadvertently become a repository of sensitive intelligence — stored video revealing site layouts and security configurations, GPS logs mapping months of corporate activity, cached Wi-Fi credentials for every network the device had connected to, and metadata exposing client sites and personnel. The article discusses how UAVs passively collect and retain data far beyond their intended purpose, and how that accumulated intelligence can be weaponised by an attacker who gains access to the device.

penetration-testing uav-security data-exposure

Case Study 2 September 2025

Hijacking the Drone Above the Construction Site

In the twenty-first instalment of From the Hacker Desk, Hedgehog Security examines a security assessment of commercial UAVs used for aerial surveying at a construction firm. Testing revealed unsecured telemetry channels, weak controller-aircraft pairing mechanisms, exposed ground station software, and the potential for command injection, surveying data manipulation, and controlled denial of service. The article explores the emerging attack surface of commercial drone operations and why organisations deploying UAVs must treat them as networked computing platforms, not flying cameras.

penetration-testing uav-security drone-hacking

penetration-testing guest-wifi network-segmentation

Case Study 5 August 2025

From Guest Wi-Fi to Sensitive Data

In the twentieth instalment of From the Hacker Desk, Hedgehog Security traces a path from a guest wireless network — intended to provide internet-only access for visitors — to sensitive corporate data, through a chain of misconfigured firewall rules, a shared print services VLAN, and an overlooked network bridge. The article dissects how assumptions about guest isolation frequently collapse under scrutiny and provides a methodology for validating that guest networks are genuinely isolated.

penetration-testing password-cracking credential-security

Case Study 1 July 2025

Cracking 60% of Passwords in a Single Afternoon

In the nineteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how ARP poisoning, LLMNR/NBT-NS abuse, and NetNTLMv2 relay and capture — combined with offline hash cracking — yielded sixty per cent of an organisation's domain passwords in a single afternoon. The article examines why traditional password policies produce predictably weak passwords, why compliance-driven complexity rules create an illusion of security, and how modern passphrase strategies and technical controls can fundamentally change the economics of credential attacks.

penetration-testing cctv-security physical-security

Case Study 3 June 2025

Turning a CCTV System into an Intelligence Hub

In the eighteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a CCTV management interface — accessible from the corporate network with default credentials — became a reconnaissance goldmine, revealing network topology, stored credentials for adjacent systems, and administrative access to physical security infrastructure. The article explores why surveillance systems are consistently underestimated as attack surfaces and how their privileged network position makes them ideal pivot points.

penetration-testing api-security web-application

Case Study 6 May 2025

Escalating Through Misconfigured API Endpoints

In the seventeenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a modern web application with no traditional injection vulnerabilities was compromised through API logic flaws — broken object-level authorisation, mass assignment, and insecure direct object references. The article examines why the evolution from monolithic web applications to API-driven architectures has shifted the attack surface from code injection to authorisation logic, and why testing must evolve accordingly.

penetration-testing social-engineering usb-security

Case Study 1 April 2025

The USB That Opened the Door

In the sixteenth instalment of From the Hacker Desk, Hedgehog Security recounts a controlled USB drop exercise that demonstrated how human curiosity consistently overrides security policy. The article analyses the technical and human dimensions of USB-based attacks, evaluates the effectiveness of endpoint execution policies and device control mechanisms, and examines what the results reveal about the gap between security awareness training and actual behaviour under real-world conditions.

penetration-testing ics-security ot-security

Case Study 4 March 2025

Leveraging Default Credentials in Industrial Control Systems

In the fifteenth instalment of From the Hacker Desk, Hedgehog Security examines an engagement where an operational technology network retained manufacturer-default credentials on programmable logic controllers, human-machine interfaces, and engineering workstations. The article explores the unique challenges of testing ICS environments, the consequences of configuration inertia, and why the convergence of IT and OT networks demands a fundamentally different approach to security assessment.

Case Study 4 February 2025

Breaking Into Wi-Fi from the Car Park

In the fourteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how corporate wireless networks were compromised from outside the building perimeter — from a vehicle in the car park. The article details modern wireless attack methodology including PMKID capture, WPA2 PSK cracking, evil twin attacks, and the exploitation of legacy wireless configurations, and explains the defensive controls that organisations frequently overlook.

penetration-testing wireless-security wifi-hacking

Case Study 7 January 2025

When Backup Systems Became the Attack Vector

In the thirteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how backup appliances — implicitly trusted and rarely scrutinised — provided a direct path to an organisation's most sensitive data. Outdated firmware, exposed management interfaces, and default credentials on the backup infrastructure yielded access to full system images, database dumps, and Active Directory backups. The article argues that resilience systems must be treated as high-value targets deserving the same security rigour as the production systems they protect.

penetration-testing backup-security data-protection

Case Study 3 December 2024

Abusing Cloud Permissions to Escalate Privileges

In the twelfth instalment of From the Hacker Desk, Hedgehog Security details how a misconfigured Azure custom role allowed privilege escalation from a low-privileged developer account to Global Administrator — without exploiting a single software vulnerability. The article traces the path through overpermissive role assignments, service principal abuse, and token manipulation, and examines why cloud IAM misconfigurations are the most prevalent and least understood class of risk in modern enterprise environments.

penetration-testing cloud-security azure

Case Study 5 November 2024

Social Engineering the Reception Desk

In the eleventh instalment of From the Hacker Desk, Hedgehog Security recounts a physical social engineering engagement where no technical exploitation was used. Through carefully constructed pretexts, open-source intelligence, and an understanding of human psychology, the team gained controlled access to internal areas including server rooms, executive offices, and restricted floors. The article examines human-layer vulnerabilities, the psychology behind successful social engineering, and why technical controls alone cannot defend against a determined adversary.

penetration-testing social-engineering physical-security

Case Study 1 October 2024

The VLAN That Wasn't Really Segmented

In the tenth instalment of From the Hacker Desk, Hedgehog Security dissects an engagement where network segmentation existed in design documentation but was not enforced in practice. Misconfigured firewall rules, accumulated exceptions, and a lack of validation testing allowed unrestricted lateral movement between VLANs that should have been isolated. The article examines how segmentation failures occur, how they persist undetected, and how to validate them effectively.

penetration-testing network-segmentation firewall-rules

Case Study 3 September 2024

The Forgotten Test Server That Held the Crown Jewels

In the ninth instalment of From the Hacker Desk, Hedgehog Security describes how an overlooked development server — absent from the asset register and excluded from patching cycles — contained full production database backups including customer PII, financial records, and authentication credentials. The article explores asset management failures, shadow infrastructure, and the systemic risk of development environments that nobody owns.

penetration-testing asset-management shadow-it

penetration-testing endpoint-security asset-management

Case Study 6 August 2024

How an Intern's Laptop Became Our Beachhead

In the eighth instalment of From the Hacker Desk, Hedgehog Security demonstrates how inconsistent endpoint hardening across a corporate estate left a single under-managed device without modern EDR controls or current patching. The article traces how that device — assigned to a summer intern — became the foothold that undermined an otherwise mature security architecture and ultimately led to domain compromise.

penetration-testing vpn-security trust-relationships

Case Study 2 July 2024

Exploiting Trust Between Two Offices

In the seventh instalment of From the Hacker Desk, Hedgehog Security details how a site-to-site VPN established years prior created implicit trust between a hardened head office and a lightly secured satellite location. By compromising the weaker environment and pivoting through the tunnel, the team achieved domain-level access to the head office without ever setting foot in the building. The article analyses trust relationships, flat networks, and inherited risk.

penetration-testing iot-security firmware-analysis

Case Study 4 June 2024

Breaching the Network Through the Coffee Machine

In the sixth instalment of From the Hacker Desk, Hedgehog Security explains how an internet-enabled coffee machine installed for staff convenience exposed a poorly secured web interface on the corporate network. Through enumeration, firmware analysis, and credential extraction, the team demonstrated how consumer IoT embedded in corporate environments introduces systemic risk that traditional security controls cannot address.

penetration-testing phishing social-engineering

Case Study 7 May 2024

Phishing the Finance Director in 11 Minutes

In the fifth instalment of From the Hacker Desk, Hedgehog Security walks through a spear-phishing engagement that compromised a senior executive's Microsoft 365 account in under eleven minutes. The article details modern phishing tradecraft including adversary-in-the-middle token harvesting, session cookie replay, and conditional access bypass — demonstrating why multi-factor authentication must be implemented correctly to provide meaningful protection.

penetration-testing active-directory printer-security

Case Study 2 April 2024

When the Printer Became the Domain Administrator

In the fourth instalment of From the Hacker Desk, Hedgehog Security details how a multifunction printer with default credentials and exposed SMB shares yielded service account passwords that escalated into full Active Directory domain compromise. The article walks through credential extraction from embedded web interfaces, LDAP bind harvesting, and the systemic risk posed by devices that every organisation owns but few bother to secure.

penetration-testing maritime-security physical-security

Case Study 5 March 2024

A Paperclip, a Superyacht, and a Bypassed Keylock

In the third instalment of From the Hacker Desk, Hedgehog Security recounts how a physical keylock protecting a superyacht's satellite internet uplink cabinet was bypassed with a common office supply. The article explores the interplay between physical and cyber controls in maritime environments, and details how access to the connectivity stack exposed the vessel's entire network to compromise.

Case Study 6 February 2024

Turning the Lift into a Mobile Reconnaissance Platform

In the second instalment of From the Hacker Desk, Hedgehog Security examines how lift control software exposed diagnostic interfaces over an internal network during an OT-enabled building assessment. The article details how weak segmentation and insecure service configurations allowed the team to transform a lift car into a moving wireless survey and network discovery platform, exposing the dangerous convergence of Operational Technology and corporate IT.

penetration-testing operational-technology iot-security