USB Rubber Ducky (Keystroke Injection Hacking Hardware)

USB Rubber Ducky (Inventor Of The Keystroke Injection Attack Vector)

The USB Rubber Ducky is the device that invented keystroke injection as an attack vector. It's a USB device that looks exactly like a generic flash drive but presents to the target computer as a USB keyboard. It types pre-programmed keystroke sequences at superhuman speed — up to 1000 words per second. Because it's seen as a keyboard by the OS, no antivirus, no application allow-listing, no endpoint detection stops it. Keyboards are trusted by default. There have been two hardware generations. You almost certainly have the Mark II (2022) if you bought recently. I'll cover both, then focus deep on the current model.

Hardware Specifications

USB Rubber Ducky Mark I (2011–2022)

The original. A bare blue PCB in a generic flash drive shell. Still functional but limited to DuckyScript 1.0:

Component	Specification
CPU	Atmel AT32UC3B1256 — 60 MHz, 32-bit AVR32 architecture
Onboard Flash	256 KB (firmware storage)
RAM	32 KB SRAM
USB	2.0 High Speed, Type-A male connector
Storage	MicroSD slot, FAT formatted, up to 2 GB capacity
Button	Micro push button — restart/replay payload
LED	Multi-color status indicator
JTAG	Exposed interface with GPIO pins
Bootloader	Atmel DFU (Device Firmware Upgrade), unlocked
Power	Bus-powered via USB (5V, ~200 mA)
Typing Speed	~1000 words/minute sustained; burst faster
OS Compatibility	Windows, macOS, Linux, Android, iOS, ChromeOS — anything that accepts USB HID keyboards
Firmware	Flashable via DFU (community forks exist)

USB Rubber Ducky Mark II (2022–Present)

Complete hardware redesign. Same attack concept, modernized internals, housed in the same innocuous flash drive casing. This is the current retail model — $59.99 at shop.hak5.org:

Component	Specification
Physical Form	USB flash drive form factor, identical to generic thumb drive. Metal sheath over plastic body.
USB Connectors	USB-C AND USB-A — the drive cap conceals a USB-C connector; the main body ends in USB-A. Attacks desktop, laptop, tablet, phone.
Storage	MicroSD card slot (accessible by removing the metal sheath and opening the case). FAT/ExFAT. Ships with a pre-formatted card.
Button	Squeeze-to-press — hidden under the plastic casing. Add included sticker dots to reduce the squeeze force needed.
LED	Multi-color status LED visible through the casing
Compatibility	Backwards compatible with all DuckyScript 1.0 payloads. Thousands of classic payloads work without modification.
DuckyScript Support	DuckyScript 3.0 native
Key Features	OS detection, hardware ID cloning, dynamic ATTACKMODE, Keystroke Reflection, jitter/randomization, brute-force frameworks, variables, functions, IF/WHILE flow control, extensions
Compilation	PayloadStudio (web IDE) ONLY. No offline encoder. No firmware flashing. Drag-and-drop inject.bin to the "DUCKY" mass storage device.

Critical warning from Hak5: Do NOT flash firmware on the Mark II. The architecture has been redesigned so that firmware flashing is never necessary. Flashing legacy or third-party firmware will permanently brick the device. This is not the old Ducky where you could recover via DFU. The warranty does not cover firmware flash damage.

What's In The Box

When you open the retail package:

• USB Rubber Ducky (pre-assembled in its flash drive casing with metal sheath)

• MicroSD card (pre-installed, pre-formatted with a default label of "DUCKY")

• Sticker sheet — small "raindrop" dot stickers for the button mod

• MicroSD to USB adapter (so you can plug the MicroSD into a computer for direct file transfer, though the Ducky itself can mount as storage)

The Button - Arming Mode & Operation

The button on the Mark II works differently from the Mark I.

On the Mark I, pressing the button replayed the payload. That was it.

On the Mark II, the button controls arming mode:

1. Plug in the Ducky without pressing anything. It immediately executes the payload in inject.bin. This is the default behavior — plug in, attack fires.

2. Plug in the Ducky, wait for it to enumerate, THEN press the button. It stops whatever it's doing, re-enumerates as a mass storage device (flash drive), and mounts as "DUCKY" on the target. You can now:

   • Replace inject.bin with a new payload

   • Read exfiltrated data if your payload wrote files to the MicroSD

   • Arm a different payload

3. Wait for button press to execute. With BUTTON_DEF in your DuckyScript, the Ducky waits until the button is physically pressed before injecting keystrokes. LED blinks to indicate "armed and waiting." This gives the operator precise timing control.

Do NOT hold the button while inserting. That triggers no special mode on the Mark II — unlike the old Ducky where button-on-insert triggered DFU firmware flashing mode. On the Mark II, button-while-inserting simply doesn't work for anything.

The Sticker Mod

The button is deliberately hard to press — it's a squeeze, not a click. This prevents accidental triggers. For practical use, add 2–3 layers of the included "raindrop" dot stickers to the inside of the case opposite the button. This builds up a contact point so a gentle squeeze registers. Too many layers and the button is permanently depressed (that's bad — constant button-hold means it won't enumerate properly). Test and adjust.

How It Works - From Insertion To Shell

The entire attack chain takes 2–8 seconds:

[Insert Ducky into USB port]
      │
      ▼
[USB enumeration ~1 second]
      │
      ▼
[OS: "New HID keyboard detected" — no driver, no prompt, no user interaction]
      │
      ▼
[Ducky reads inject.bin from MicroSD]
      │
      ▼
[DuckyScript runtime interprets bytecode]
      │
      ▼
[Payload executes: DELAY → GUI r → DELAY → STRING powershell ... → ENTER]
      │
      ▼
[Reverse shell connects to your listener]

At no point in this chain does antivirus or EDR have anything to inspect. The OS sees a keyboard typing. Keyboards are trusted. You can block USB storage devices, you can application-whitelist, you can disable PowerShell for standard users — but you cannot block keyboards without also blocking legitimate keyboards. This is the fundamental asymmetry that makes HID injection so effective.

Attack Modes (ATTACKMODE)

The Ducky doesn't have to be just a keyboard. It can present as multiple USB devices simultaneously:

ATTACKMODE HID                    → Keyboard only — stealthiest
ATTACKMODE STORAGE                → Flash drive only — for exfil
ATTACKMODE HID STORAGE            → Keyboard + flash drive (classic)
ATTACKMODE HID SERIAL             → Keyboard + serial console
ATTACKMODE HID ECM                → Keyboard + Ethernet adapter (covert channel)
ATTACKMODE HID STORAGE SERIAL     → All three

Mode Selection Strategy

Mode	Use Case
HID	Pure keystroke injection. No drive letter appears. No "would you like to format?" popup. Maximum stealth.
HID STORAGE	Injection + exfiltration. The Ducky can write captured data (passwords, files, keylogs) to the MicroSD. Trade-off: a new drive letter appears on the target, which may be noticed.
HID ECM	Keystroke injection + covert network channel. The Ducky becomes a USB Ethernet adapter. The target gets a new network interface. You can exfiltrate data or receive C2 commands over IP without touching the target's actual network. May trigger network monitoring alerts if "new network adapter" is unexpected.
HID STORAGE with VID/PID spoofing	Appear as a specific, trusted keyboard model. Bypasses naive USB device allow-listing.

Hardware ID Cloning

DuckyScript 3.0 lets you spoof the Ducky's USB descriptors to appear as any keyboard on the market:

ATTACKMODE HID VID_0x046D PID_0xC31C   → Logitech USB Keyboard
ATTACKMODE HID VID_0x045E PID_0x07A5   → Microsoft Wired Keyboard 600
ATTACKMODE HID VID_0x05AC PID_0x024F   → Apple Aluminium Keyboard
ATTACKMODE HID VID_0x04D9 PID_0x0169   → Generic Holtek keyboard

For organizations that use USB device control software (allowing only approved VID/PID combinations), this bypasses the whitelist — the Ducky claims to be an approved keyboard and the software lets it through. You can also spoof manufacturer string, product string, and serial number for deeper impersonation.

Built-In Attack Capabilities (Unique To Mark II)

Passive OS Detection

The Mark II can identify the target operating system in under one second, without sending any keystrokes. It passively observes USB enumeration timing, descriptor request patterns, and HID protocol nuances to fingerprint Windows, macOS, Linux, ChromeOS, Android, and iOS.

In DuckyScript 3.0:

EXTENSION DETECT_OS

VAR $os = DETECT_OS

IF ($os == "WINDOWS") THEN
    ; Windows payload
ELSE IF ($os == "MACOS") THEN
    ; macOS payload
END_IF

One payload, any target, zero recompilation. Drop a Ducky in a parking lot and it adapts to whatever machine someone plugs it into.

Keystroke Reflection

A technique that exploits the fundamental design of USB keyboards — specifically the bidirectional nature of the HID protocol. The Ducky can read the state of the target's keyboard LEDs (Num Lock, Caps Lock, Scroll Lock) to infer what the OS is doing, and it can also observe how the OS responds to injected keystrokes.

This enables:

• Success confirmation: Inject a command, reflect on the LED state to confirm it executed

• Brute-force with feedback: Try a PIN, check if the screen changed (via reflected HID state), try again

• Data exfiltration without network: Encode a byte in keyboard LED states, read it via a camera or light sensor

Jitter and Randomization

Mimic human typing cadence to evade behavioral detection:

DEFAULT_JITTER 25            → Random ±25ms added to every keystroke delay
DEFAULTDELAY 50              → Base delay 50ms
; Actual delay per keystroke: 25-75ms (pseudo-random, human-like)

DELAY RANDOM 500 2000        → Random delay between 500-2000ms

Why this matters: some endpoint security products profile keyboard input timing. 1000 keystrokes arriving at exactly 18ms intervals is a machine. 1000 keystrokes with µs-level variation clustered around a mean is a Ducky. But 1000 keystrokes with the erratic, fat-tailed timing distribution of a real typist passes the behavioral filter.

Storage Activity Detection

The Ducky can detect when the target OS is accessing its mass storage partition. This is useful for:

• Timing exfiltration: Wait until the OS has fully mounted and indexed the drive before writing captured data

• Detecting forensic tools: If the OS suddenly accesses the MicroSD outside the expected window, something is reading it — possibly a security tool on the hunt

• Self-destruct triggers: If unexpected storage access is detected, the Ducky can wipe the MicroSD

DuckyScript 3.0 On The Rubber Ducky - Language Coverage

I covered DuckyScript in depth in the previous response, but here's the feature set specifically available on the Rubber Ducky Mark II:

Feature	Available?	Note
STRING, DELAY, ENTER, GUI, all classic key commands	✅	Full backwards compatibility
DEFAULT_DELAY / DEFAULTDELAY	✅
REPEAT n	✅
LED control (LED_R, LED_G, LED_B)	✅	Multi-color LED
ATTACKMODE with VID/PID spoofing	✅	Full hardware ID cloning
Variables ($var = value)	✅	String and integer
IF / ELSE / ELSE IF / END_IF	✅	Full conditional branching
WHILE / END_WHILE	✅	Loop constructs
FUNCTION / END_FUNCTION	✅	With parameters and return values
BUTTON_DEF	✅	Wait for button press
#include, #define, #ifdef	✅	Preprocessor
EXTENSION DETECT_OS	✅	Passive OS fingerprinting
DEFAULT_JITTER	✅	Human-like typing cadence
RANDOM(min,max)	✅	Random delays
Keystroke Reflection	✅	Bidirectional HID state reading
Storage activity detection	✅
Keylogger	❌	Not on Ducky. Use Key Croc or O.MG Cable Elite.
WiFi / BLE	❌	No wireless radio. Use Pager or O.MG Cable.
Self-destruct	❌	No hardware self-destruct. O.MG Cable Elite only.
Geofencing	❌	No location hardware.

MicroSD - Capacity, Formatting, And Inject.bin

The MicroSD is where the magic lives. Technical details:

Parameter	Mark I	Mark II
Filesystem	FAT (FAT16)	FAT or exFAT
Max card size	2 GB	Larger capacities supported (tested up to 32 GB)
Required file	inject.bin at root	inject.bin at root
How to load payload	Compile in PayloadStudio → download inject.bin → copy to MicroSD root
Alternative method	—	Use arming mode: plug Ducky, press button, it re-enumerates as "DUCKY" flash drive, drag-and-drop inject.bin

The MicroSD must be formatted correctly. If you swap cards, format the new card as FAT32 or exFAT, label it "DUCKY" (optional but helpful), and place inject.bin at the root.

Complete Attack Chain - Real Engagement Example

Here's how the Rubber Ducky is actually used in an authorized physical pentest:

Phase 1: Recon and Payload Preparation

1. Identify the target OS from pre-engagement intel (Windows 10 Enterprise, US keyboard layout, Defender ATP)

2. Write a staged reverse shell in DuckyScript 3.0 with OS detection as a fallback

3. Test on a lab VM matching the target build — tune delays, confirm antivirus doesn't flag the download cradle

4. Compile to inject.bin

Phase 2: Staging the Device

1. Copy inject.bin to the Ducky's MicroSD

2. Optionally add a decoy PDF or spreadsheet to the MicroSD's storage partition — named something intriguing like "Salary_Review_Q4.xlsx" or "Layoff_List_DRAFT.pdf" — to increase the chance the target opens the storage and plugs it in

3. Optionally re-label the Ducky's volume from "DUCKY" to something innocuous (the volume label is visible when the storage partition mounts)

Phase 3: Delivery

Options from least to most aggressive:

• Walk-by drop. Walk past the target's desk during a meeting, let the Ducky "fall" onto the floor near their bag. They pick it up, see a flash drive, curiosity wins.

• Parking lot drop. Place near the employee entrance at 8:15 AM. Someone picks it up on their way in.

• Reception hand-off. "Hey, I found this USB in the parking lot. I think someone dropped it." Hand it to the receptionist. They'll plug it in to see whose it is.

• Mailing. Package the Ducky with a convincing label and drop it in the mailroom. "IT Department — Security Token."

Phase 4: Execution and Callback

1. Target plugs in the Ducky (curiosity, or "let's see who this belongs to")

2. Ducky enumerates as a keyboard

3. DELAY 3000 — waits for the OS to finish USB handshake and autorun scanning (if storage mode)

4. EXTENSION DETECT_OS — confirms Windows 10

5. GUI r → DELAY 300 → STRING powershell... — download cradle fires

6. Stage 1 beacon hits your C2 server. You now know: hostname, username, domain, internal IP, AV status

7. From your C2 console, push Stage 2 — a more full-featured implant

8. The Ducky continues its script: closes windows, clears Run dialog history, maybe writes a decoy file to the MicroSD for later retrieval

Phase 5: Cleanup and Recovery

1. When the target eventually unplugs the Ducky (or at end of day), retrieve it from wherever it was left

2. If you can't retrieve it — that's fine. The MicroSD only has inject.bin and some decoy files. The C2 callback domain was burned after the engagement anyway.

3. Wipe the MicroSD

4. Document in the report: drop location, time of insertion, time of first callback, exfiltrated data

Rubber Ducky vs. Other Hak5 Implants - When To Use Which

Scenario	Best Tool	Why
Target has USB ports accessible	Rubber Ducky	Cheapest ($59.99), simplest to deploy, most "it's just a flash drive" deniability
Target uses USB-C only devices	Rubber Ducky (Mark II) or O.MG Cable	Mark II has USB-C. O.MG Cable is USB-C native and looks like a real charging cable.
You need remote trigger (not just plug-and-go)	O.MG Cable	WiFi remote control. Trigger the payload when the time is right, not when the cable is first plugged in.
You need a hardware keylogger plus injection	Key Croc	Sits inline between keyboard and PC. Keylogs continuously. Triggers injection when specific keywords are typed ("password").
Target is a network, not a computer	Packet Squirrel or Shark Jack	Ethernet implants. Packet Squirrel for MITM, Shark Jack for rapid network recon.
You need to place a device and walk away for days	O.MG Cable Elite or Key Croc	Persistent, remote-triggerable, battery-backed on some models
Maximum payload complexity with extensions	O.MG Cable Elite or Pager	Full DuckyScript 3.0 with WiFi, BLE, HTTP, keylogger, self-destruct, geofencing extensions
Budget-constrained, simple goal (get a shell)	Rubber Ducky	$59.99 does the job. No WiFi needed. Just plug it in.
Multi-target, same building, leave-and-forget	Multiple Rubber Duckys	$60 each, scatter 5-10 around the office in different locations

Quick Reference: First Payload

Open PayloadStudio, paste this, compile, copy to Ducky:

REM Hello world — opens Notepad, types a message
DELAY 3000
GUI r
DELAY 500
STRING notepad
ENTER
DELAY 1000
STRING This computer was accessed by an authorized USB Rubber Ducky during a scheduled penetration test.
ENTER
STRING If you found this device, please return it to the security team.

This harmless test confirms everything works: enumeration, timing, keystroke injection, and application launching. Run it on your lab machine first. When it works, swap in your real payload.