How to Use the Flipper Zero as a USB Rubber Ducky

How to Use the Flipper Zero as a USB Rubber Ducky The Flipper Zero can act as a USB HID keyboard (BadUSB mode), executing keystroke injection payloads just like a USB Rubber Ducky. This is useful for automating setup tasks, testing endpoint security, or building physical access tools. How It Works When plugged into a USB port, the Flipper identifies itself as a keyboard. It then types a script at machine speed — far faster than any human. The target computer sees only keystrokes, not a USB drive or unknown device. Payload Location Payloads (.txt files in Ducky Script format) go on the SD card at: /ext/badusb/ Basic Ducky Script Syntax ducky REM This is a comment DELAY 1000 -- Wait 1000ms (1 second) STRING Hello world -- Type this text ENTER -- Press Enter CTRL SHIFT ESC -- Keyboard shortcut GUI r -- Windows key + R (Run dialog) ALT F4 -- Close window Example — Open Notepad and Type Text (Windows) ducky REM Open Notepad and type a message DELAY 500 GUI r DELAY 500 STRING notepad ENTER DELAY 1000 STRING Hello from Flipper Zero! ENTER STRING This is a BadUSB test payload. Example — Open Terminal on Mac ducky REM Open Terminal on macOS DELAY 500 GUI SPACE DELAY 500 STRING Terminal ENTER DELAY 1500 STRING echo "Flipper was here" ENTER Example — Lock the Screen (Windows) ducky REM Lock Windows screen GUI l Running a Payload 1. Copy your .txt payload to /ext/badusb/ on the Flipper SD card 2. On Flipper: BadUSB → select your payload → Run 3. Plug Flipper into the target computer via USB-C 4. Press the center button to execute Payload Tips DELAY is critical — always add delays after opening applications. Machines vary in speed. When in doubt, add more delay. DEFAULTDELAY sets a delay between every command: DEFAULTDELAY 100 REPEAT 5 STRING abc repeats the command 5 times Test on your own machines first PowerShell payloads need STRING powershell then ENTER with adequate delay before typing commands Avoiding Detection Some endpoint security flags fast keystroke injection — add DEFAULTDELAY 50 to slow it down Windows Defender and most AV don't block keystroke injection by default (it's a fundamental OS feature) USB Device Control policies in corporate environments may block unrecognized HID devices Community Payload Resources Hak5 Payload Library — written for Ducky Script v2, most compatible UberGuidoZ Flipper BadUSB — Flipper-specific payloads This is for educational use and authorized testing only. Running payloads on systems you don't own or have permission to test is illegal.

Related Guides

Loading_