Looks like a flash drive.
Types like a keyboard.

Write payloads with a simple scripting language or online payload generator.

Encode payloads with cross-platform tools and copy each to a micro-SD card.

Conceal inside the included generic flash drive case for stealthy deployments.

Execute attacks against Windows, Mac, Linux and Android targets in seconds.

Computers inherently trust keyboards.
Fully automate keystrokes in seconds.

The USB Rubber Ducky is a keystroke injection tool disguised as a generic flash drive. Computers recognize it as a regular keyboard and automatically accept its pre-programmed keystroke payloads at over 1000 words per minute.

Since 2010 the USB Rubber Ducky has captured the imagination of hackers with its simple scripting language, formidable hardware and covert design.

Nearly every device from desktop to smartphone accepts human input from keyboards. The ubiquitous USB HID standard makes this possible. When the USB Rubber Ducky is plugged it, it’s detected as a keyboard and it’s pre-programmed keystrokes are accepted by modern operating systems. From Windows and Mac to Linux and Android – the Keyboard is King.

By taking advantage of this inherent trust, the USB Rubber Ducky executes scripted keystrokes at over 1000 words per minute.  Seconds of physical access are all it takes to deploy some of the most advanced pentest attacks or IT automation tasks.

Payloads are crafted using a simple scripting language and can be used to drop reverse shells, inject binaries, brute force pin codes, and many other automated functions for the penetration tester and systems administrator.

  • WIN r pulls up the Windows run dialog
  • DELAY 1500 pauses for 1.5 seconds.
  • STRING Hello World types “Hello World”
  • ALT F4 closes the window

That’s the basics. You just learned Ducky Script!

When designing the USB Rubber Ducky we set out to make the easiest, most efficient and most effective device possible. We seeded hundreds of developers around the wide with prototype boards. Based on their feedback, we refined the experience.

The result is a remarkably simple, powerful and versatile platform.

  • Fast 60 MHz 32-bit processor
  • Universal type A USB connector
  • Expandable memory via micro-SD
  • Inconspicuous flash drive enclosure
  • Programmable payload replay button


With the USB Rubber Ducky, Hak5 invented the keystroke injection attack.
Nothing else compares.