Skip to main content

USB Rubber Ducky — The Complete Guide

一句話定位：USB Rubber Ducky 是一支「會自己打鍵盤」的隨身碟 — 插入 USB 孔後，它以每秒數百次的速度把預錄好的按鍵輸進電腦，10 秒內做完一個人工要花五分鐘的動作。這是所有 Hak5 裝置裡最適合初學者入門的機器。

When you plug in any USB keyboard, the computer trusts it instantly — no password, no "are you sure?" prompt. The USB Rubber Ducky exploits exactly that trust. It presents itself to the OS as a regular keyboard (a HID device, Human Interface Device), then replays a script of keystrokes so fast that a human could never keep up.

The Ducky does one thing, extremely well: keystroke injection. It doesn't need exploit code or vulnerabilities — it just types. That makes it the perfect teaching tool for HID attacks, and the foundation for every other Hak5 payload device.

⚠️ Authorised testing only. Use the Ducky on your own computer, your own machines in a lab, or with explicit permission. Injecting keystrokes into someone else's computer is illegal (Taiwan: 刑法第 358–363 條).

Specs at a glance​

ItemSpecification
PurposeKeystroke injection (HID attack)
LanguagesDuckyScript 1.0 (classic) and 3.0 (full language)
Script storageMicroSD card (comes included; keep the small one for fastest boot)
OutputCompiled inject.bin on the DUCKY drive
Injection modesHID, Storage, Serial, Ethernet (various attack modes)
InterfaceUSB-A (plug it into any USB host)
FeedbackSingle button (default: exits to arming/storage mode)
EncoderPayloadStudio (official, browser-based) — the only supported compiler
Official docshttps://docs.hak5.org/hak5-usb-rubber-ducky

Anatomy​

PartPurpose
USB-A plugThe "keyboard" side — goes into the target
MicroSD slotHolds inject.bin and payload scripts
The buttonDuring/after a payload, defaults to returning to storage (arming) mode
Flippable USB-A headBoth orientations (standard & reversed connector)

DuckyScript — the language​

DuckyScript is deceptively simple. Classic scripts are just STRING (type this) + DELAY (wait). Version 3.0 adds real programming power: if/else, while loops, functions, and ATTACKMODE control.

The "Hello, World!" payload​

REM This is a comment — type into whatever application is focused
DELAY 1000
STRING Hello from my USB Rubber Ducky!
ENTER

What happens: the Ducky waits 1 second, then types Hello from my USB Rubber Ducky! and presses Enter into whatever window is active.

Control-flow example (DuckyScript 3.0)​

ATTACKMODE HID
DELAY 1000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 800
REM Only type if the window title changed (keystroke reflection)
VAR $os = GET_SYSTEM_ID
IF ($os == "WINDOWS") THEN
    STRING Running on Windows!
    ENTER
ELSE
    STRING Running on something else.
    ENTER
END_IF

You might be asking: "Isn't 'type into whatever is focused' fragile?" Yes — which is why real payloads open an application first (here, GUI r → notepad), then type. Always control your own focus before injecting.

Quickstart — your first payload, 5 minutes​

Step 1 — Write the payload in PayloadStudio​

  1. Open https://payloadstudio.hak5.org (Community edition is free).
  2. Paste the Hello World script above.
  3. Select your target keyboard layout (default US). This matters — inject with the wrong layout and keys come out garbled.
  4. Click Generate Payload. PayloadStudio compiles it to inject.bin.

Step 2 — Arm the Ducky​

Plug the Ducky into your computer. It mounts as a flash drive called DUCKY — this is arming mode.

Step 3 — Copy the payload​

Copy inject.bin to the root of the DUCKY drive, replacing the existing file. Eject safely, unplug.

Step 4 — Deploy​

  1. Open Notepad on your target machine (your own laptop, in your lab).
  2. Plug in the Ducky.
  3. Watch — it types Hello from my USB Rubber Ducky! and presses Enter.
# On Linux, verify the Ducky enumerates as a keyboard when armed:
lsusb | grep -i ducky
# Expected: Bus 001 Device 00X: ID .... Hak5 LLC USB Rubber Ducky

The attack modes (ATTACKMODE)​

The Ducky can present as more than a keyboard. ATTACKMODE chooses the device personality:

ATTACKMODEThe Ducky pretends to beUsed for
HIDKeyboardKeystroke injection (default if none specified)
HID STORAGEKeyboard + flash driveInject and stay accessible as storage
STORAGEFlash driveArming / file transfer only
SERIALSerial deviceTalk to a serial console
HID SERIALKeyboard + serialInject into a serial-connected box

A common pattern — inject, then drop into storage so you can grab loot:

ATTACKMODE HID STORAGE
DELAY 2000
...payload keystrokes...
ATTACKMODE STORAGE

Keyboard layouts — the classic gotcha​

The Ducky doesn't type "the letter A" — it presses the physical key for A on a US keyboard, then reproduces that keypress. Type on a German or French keyboard with a US-layout payload and you get completely different characters.

Rule: compile with the keyboard layout of the target machine, not your own. Set it in PayloadStudio before generating.

SymptomCause
@ becomes "Payload compiled US, target is UK/German
Numbers turn into symbolsLayout mismatch on the shifted row
Nothing types at allMissing DELAY (OS HID stack not ready) or wrong attack mode

Advanced​

TechniqueHow
Keystroke reflectionRead target state/window title and branch (IF with system queries)
Mouse injectionMove the cursor / click — useful for GUI-only targets
Jitter & randomizationAdd human-like delays to evade keystroke-timing detection
Payload librariesDrop in scripts from the community repo (see Firmware & Downloads)
Combined HID+EthernetOn compatible firmware, act as keyboard + attacker's own network interface
RecoveryPress & hold the button to re-enter storage mode from a runaway payload

Pro tip for labs: always test a new payload against your own disposable VM first. A typo in a real-world payload types garbage into a real machine — and a rogue ATTACKMODE ETHERNET on an unsupported host can brick the session. Practice in a sandbox.

Troubleshooting​

SymptomCauseFix
Nothing appears on screenNo DELAY at start; OS USB stack not readyAdd DELAY 1000 as the first line
Wrong characters typedKeyboard layout mismatchRecompile with target's layout in PayloadStudio
Payload ran once but not againOld inject.bin overwrote yoursCopy your .bin to drive root again
Can't get back to arming modePayload overrode the button defaultPress button; if no BUTTON_DEF, default behaviour returns you to storage. See docs
Button does unexpected thingsPayload uses BUTTON_DEFCheck your payload; example scripts may remap the button
Firmware-flash warningsThird-party firmwareNever flash — the Ducky is architectured to not need it; flashing voids warranty and can brick the device

Critical warning: Do NOT flash the USB Rubber Ducky. It ships designed around PayloadStudio so you never need to. Legacy/third-party firmware can render it permanently unrecoverable. Always use official updates only — see Firmware & Downloads.