BadUSB and DuckyScript

Plug the Flipper into a computer over USB and the computer may see a keyboard. Anything a keyboard can type, a script can type. That class of attack is called BadUSB; the common language is DuckyScript, from Hak5's USB Rubber Ducky. Flipper speaks a DuckyScript dialect documented in the official Bad USB pages.

The language, briefly

Scripts are text files on the SD card. The Flipper types them with the layout you pick (US QWERTY is the usual lab default; a mismatch produces garbage). DELAY is not optional — the OS needs time to open Run or Spotlight.

REM Own PC only. Opens Notepad and types a line.
DELAY 500
GUI r
DELAY 400
STRING notepad
ENTER
DELAY 600
STRING Field Manual lab. This is my machine.
ENTER

REM Own Mac only.
DELAY 500
GUI SPACE
DELAY 400
STRING textedit
ENTER
DELAY 800
STRING Field Manual lab. This is my machine.

What this is for

• Seeing why an unlocked, unattended PC is already a lost PC.
• Automating a setup step on your own bench.
• Writing a payload that is readable, commented, and reversible.

A payload that harvests passwords, opens reverse shells, or phishes a human is malware. Hosting or running that against anyone else is a crime. This course stops at 'the machine accepted keystrokes I authored, on hardware I admin, and I can read the script in a text editor.'

Keyboard layouts and HID ID

If STRING produces the wrong symbols, the layout is wrong — not the Flipper. Some operating systems also prompt on a new HID device. That prompt is working as designed. Do not look for ways to hide the device from the person who owns the computer; that person should be you.