August 23, 2026
I Tested My Own Laptop Like a Hacker..The Results Were Embarrassing
I thought my laptop was secure because I had antivirus, a firewall, a strong password, and years of cybersecurity knowledge. Then I stopped…
By Satyam Pathania
10 min read
I thought my laptop was secure because I had antivirus, a firewall, a strong password, and years of cybersecurity knowledge. Then I stopped trusting myself and started looking at my computer like an attacker…
Free access for Non-Medium members — click here
There is a very comfortable assumption we make about our computers: if nothing strange has happened, everything must be fine.
I believed it too.
My laptop had a password. Windows Security was running. The firewall was enabled. I kept most of my software updated, and I wasn't downloading suspicious .exe files from websites that looked like they were designed during the Windows XP era.
I also spend an embarrassing amount of time learning cybersecurity, so I had convinced myself that I probably knew what I was doing.
Then I decided to stop looking at my laptop as its owner and look at it as an attacker.
That small change in perspective made the machine look completely different.
Instead of seeing a laptop, I started seeing accounts, applications, services, network connections, permissions, ports, browser extensions, stored information and software I had installed months ago and completely forgotten about.
And that was my first problem.
I had forgotten what was running on my own computer.
Who Am I?
I'm Satyam Pathania, also known online as 0xDiddy.
I'm a self-taught cybersecurity researcher and technical writer. Most of my work revolves around cybersecurity, ethical hacking, Linux, networking, IoT, hardware security and the practical side of learning how systems actually work.
I've spent years learning how attackers look at applications and networks, but this experiment reminded me that the same mindset is useful even when the target is something much closer to home.
Your own laptop is a great place to start learning cybersecurity because you already have permission to investigate it.
You don't need a company, a fancy penetration-testing lab or a mysterious "hacker target" from the internet.
You have a computer.
You have a network.
You have software.
And, unfortunately, you also have all the things you installed at 2 AM and forgot about.
So I decided to investigate mine.
I Started With the Most Basic Question: What Can Someone See?
Before an attacker starts looking for complicated vulnerabilities, they usually need to understand the target.
What operating system is running?
What services are available?
Which ports are open?
What applications are exposed?
Is the machine reachable from another device?
This is where the idea of an attack surface becomes useful.
Imagine your house. You have doors, windows, maybe a garage and possibly that one basement window that you keep promising yourself you'll secure.
Each one is an opportunity for someone to interact with the building.
A computer has its own version of doors. They're called ports.
A port is simply a numbered communication endpoint that allows software to communicate over a network. Different services can listen on different ports, which means discovering open ports can tell you a lot about what a computer is offering to the network.
For my own lab machine, I used Nmap to investigate the network exposure. Nmap describes port scanning as one of its fundamental capabilities, and its service/version detection can go further by probing discovered services to identify the application and, when possible, its version.
For example, in an authorized lab, a basic scan might look like:
nmap <YOUR-LAB-IP>nmap <YOUR-LAB-IP>And if I want to investigate the services behind discovered ports:
nmap -sV <YOUR-LAB-IP>nmap -sV <YOUR-LAB-IP>The important part isn't memorizing those commands.
It's understanding what you're asking.
The first question is essentially, "What doors are visible?"
The second becomes, "What's actually behind those doors?"
That distinction is where network security starts becoming interesting.
An Open Port Doesn't Mean You're Hacked
This is one of the first things beginners should understand because cybersecurity content has a habit of turning everything into a disaster.
You scan your computer.
You see an open port.
You panic.
Suddenly you're imagining a hacker sitting in a dark room somewhere, surrounded by six monitors and apparently waiting specifically for your laptop……
An open port doesn't automatically mean your computer is vulnerable.
Think about the house analogy again. A door existing doesn't mean someone has broken into the house. You need to understand what the door leads to, why it exists, who is allowed through it and whether the system behind it is properly configured.
Nmap's documentation makes this distinction particularly useful. A port number can suggest what service might be running, but Nmap's service detection actually probes the service to gather more information about what is listening there. That matters because services can run on unusual ports, and simply guessing based on the port number isn't always reliable……
This is an important cybersecurity habit: don't confuse an observation with a vulnerability….
Seeing something is the beginning of an investigation, not the conclusion
Then I Asked the Question That Made Me Slightly Uncomfortable
Once I knew what the machine was exposing, I started looking at what was actually running on it.
That meant applications, background processes and services.
Some were obvious. Some belonged to software I actively used. Some were related to development tools and hardware projects.
And then there were a few where I genuinely had to stop and think, "Why did I install this?"
That might sound harmless, but it represents a much bigger security problem.
We install software for a project and forget about it. We download a tool because a tutorial told us to. We install a development environment, experiment with it for three days and then move on to something else.
The software doesn't necessarily move on with us.
It stays.
Six months later, we have dozens of applications and services running on a computer, many of which we barely remember.
That doesn't mean they're malicious. It means we have created complexity without necessarily understanding it.
And complexity is difficult to secure.
If you don't know what a service does, why it is running or whether you still need it, you can't make a good security decision about it.
You cannot properly secure an environment you don't understand.
That became one of the biggest lessons from this entire experiment.
Then I Looked at My Firewall
I already had a firewall
For years, I've heard the same sentence from people trying to explain why their computer is secure:
"I have antivirus and a firewall"
That's better than having nothing, but it isn't the end of the conversation.
A firewall is not a magical wall that appears whenever somebody says the word "hacker" It is a system for controlling network traffic according to rules.
Microsoft describes Windows Firewall as a host-based security feature that filters traffic entering and leaving the device and can make decisions using information such as IP addresses, ports and applications. Windows also provides different network profiles, including private and public networks, because the level of trust is different between your home network and, say, a coffee-shop Wi-Fi network…….
That made me ask a much better question than "Do I have a firewall?"
I wanted to know what my firewall was actually allowing.
That's an important difference.
A security control is only useful when you understand how it is configured and what problem it is solving.
You can install ten security products and still have poor security if nobody understands what those products are doing.
Sometimes the most valuable security improvement isn't buying another tool.
It's opening the tool you already have and actually reading the settings.
Then I Started Thinking About My User Account
Next came a more uncomfortable question:
If somebody compromises my account, what can they actually do?
This is where the principle of least privilege becomes important.
Imagine you invite a plumber into your house because there's a problem with the kitchen sink. You probably don't give that person the keys to every room, your safe and the box containing your passport….
You give them enough access to do the job.
Computers should work in a similar way.
If an everyday user account has unnecessary privileges, a compromise can become much more serious. The attacker isn't just getting access to an account; they're potentially gaining access to everything that account is allowed to access…..
This is why security isn't only about stopping the first compromise.
You also need to think about what happens after something goes wrong.
A good security design assumes that at some point, something will fail.
A password can be stolen.
A vulnerability can be discovered.
A user can click the wrong thing.
An application can be compromised.
The question becomes: how much damage can happen afterward?
That way of thinking is much more useful than assuming your defenses will work perfectly forever.
Then I Opened My Browser
This was probably the most personal part of the audit.
Your browser knows an absurd amount about you.
It knows which websites you visit, which accounts you're logged into, which extensions you've installed and, depending on your configuration, may have access to saved credentials, cookies, downloads, permissions and other sensitive information.
I started reviewing my browser extensions.
Some were useful.
Some I rarely used.
And some existed because at some point I had apparently thought, "This might be useful someday."
That sentence is responsible for a shocking amount of digital clutter.
The same principle applies to browser extensions as it does to applications: if something doesn't need access to your browser anymore, removing it reduces the amount of software you have to trust…..
This doesn't mean every extension is dangerous.
It means every extension deserves a reason for being there.
Security is often about making small decisions repeatedly rather than waiting for one giant technical solution.
Then I Scanned My Home Network
This was probably my favorite part.
Because your laptop doesn't live alone.
It sits inside a network with your phone, router, television, printer, development boards, IoT devices and whatever else you've connected over the years.
I started looking at my own network from that perspective.
And I found devices I had forgotten existed.
That was more valuable than discovering some dramatic vulnerability.
It reminded me of a basic security principle that is easy to forget:
You can't properly protect an environment if you don't know what is inside it.
Imagine trying to secure a building while not knowing how many rooms it has.
You might have excellent locks on the front door while completely forgetting that the back door exists.
The same thing happens with home networks.
People spend time choosing strong Wi-Fi passwords but don't necessarily know what devices are connected, which devices are outdated or which services those devices expose.
That is why asset inventory is such a fundamental part of security.
Before you secure something, identify it.
The Most Embarrassing Discovery Wasn't a Vulnerability
After going through all of this, I realized something slightly uncomfortable.
I had spent years learning cybersecurity, yet I was still capable of making exactly the same mistakes that I would tell a beginner to avoid.
I installed software and forgot about it.
I assumed security controls were configured correctly.
I didn't regularly review everything running on my machine.
I sometimes treated "nothing has happened" as evidence that everything was fine.
But that's not how security works…
A vulnerable system doesn't become secure because nobody has attacked it yet.
A door doesn't become unbreakable because nobody has tried the handle.
And "nothing happened" isn't a security control.
It's simply an absence of an incident.
That distinction sounds obvious when you say it out loud, but it is surprisingly easy to forget.
So What Did I Actually Change?
I didn't turn my laptop into Fort Knox.
I didn't install twenty security products.
I didn't start treating every process as malware.
Instead, I did something much more practical.
I reviewed the software installed on my machine and removed things I no longer needed. I looked at services and processes I didn't recognize instead of automatically assuming they were harmless. I checked my firewall configuration and paid more attention to which network profile I was using. I reviewed browser extensions and permissions, looked at the devices connected to my network and made sure important accounts had stronger authentication.
None of those actions are particularly glamorous.
There is no Hollywood soundtrack when you uninstall an application.
Nobody makes a cybersecurity documentary about removing an old browser extension.
But security is often built from exactly these boring decisions.
The glamorous vulnerability gets the headline.
The boring configuration prevents it.
You Can Try This Without Being Technical
If you're completely new to cybersecurity, don't start by trying to break into somebody else's website.
Start with your own computer.
Open your installed applications and ask yourself why each one exists. Check whether your operating system and applications are receiving updates. Review your browser extensions. Look at your firewall settings. Check which devices are connected to your home network. Turn on multi-factor authentication for important accounts and keep backups of information you cannot afford to lose.
If you want to learn network security, build a small lab using systems you own or have explicit permission to test. Nmap's official documentation is a good starting point because it explains everything from basic port scanning to service and version detection.
You don't need an expensive cybersecurity lab to begin.
You need curiosity, a machine you are allowed to investigate and the willingness to discover that you probably installed something six months ago and have absolutely no idea why.
I've certainly done it.
What This Experiment Actually Taught Me
The biggest lesson wasn't Nmap.
It wasn't the firewall.
It wasn't Windows Security.
It wasn't even finding forgotten software.
It was learning to look at my own machine from the outside.
When you're the owner, you naturally think about what the computer is supposed to do.
When you're thinking like an attacker, you start thinking about what the computer allows.
That difference is fundamental.
Instead of asking, "Is my laptop secure?" I now find the question much more useful when phrased as:
"If I knew nothing about this machine, what would I discover?"
That question leads somewhere.
You start looking at the attack surface. You start understanding your network. You start questioning unnecessary services. You start thinking about permissions and accounts. You start considering what happens if one security control fails.
And that's when cybersecurity becomes less about memorizing hacking commands and more about understanding systems.
The Cheapest Security Audit Might Be Your Own Curiosity
We spend a lot of time learning sophisticated attacks: SQL injection, XSS, SSRF, privilege escalation, wireless attacks and exploit development.
Those subjects matter.
But sometimes the best cybersecurity exercise is much simpler.
Look at your own computer.
Look at what it exposes.
Look at what it runs.
Look at who has access.
Look at what you installed.
Then ask yourself whether all of it still needs to be there.
You don't have to make your laptop impossible to attack. That's not realistic.
The goal is to understand your environment, reduce unnecessary exposure, keep your software maintained and make an attack more difficult and less useful.
My laptop wasn't hacked during this experiment.
Instead, it did something arguably more useful.
It showed me that even after years of studying cybersecurity, there were still things on my own machine that I hadn't been paying enough attention to.
And honestly, I'd rather discover that myself than let someone else discover it first.
Buy Me a Coffee
https://buymeacoffee.com/satyampathania
Take care ❤
cybersecurity for beginners, laptop security, computer security, network security, ethical hacking, Nmap tutorial, Nmap port scanning, Wi-Fi security, Windows security, firewall security, cybersecurity basics, ethical hacking for beginners, home network security, penetration testing, attack surface, network scanning, cyber hygiene.
Cybersecurity · Ethical Hacking · Network Security · Cybersecurity for Beginners · Nmap