DuckyScript IDE — Payload Studio

DuckyScript Reference

▼

Typing

STRINGType a string of text

STRINGLNType string then press ENTER

Key Actions

ENTERPress Enter key

TABPress Tab key

ESCAPEPress Escape key

BACKSPACEPress Backspace

DELETEPress Delete key

SPACEPress Space bar

UPARROWPress Up arrow

DOWNARROWPress Down arrow

LEFTARROWPress Left arrow

RIGHTARROWPress Right arrow

CAPSLOCKToggle Caps Lock

PRINTSCREENPrint screen

PAUSEPause key

NUMLOCKToggle Num Lock

HOMEHome key

ENDEnd key

PAGEUPPage Up key

PAGEDOWNPage Down key

F1 – F12Function keys

Modifiers

GUIWindows / Super key

ALTAlt key (combine: ALT F4)

CTRLControl key

SHIFTShift key

CTRL ALT DELETESecure attention sequence

Timing & Control

DELAY NWait N milliseconds

DEFAULTDELAY NSet default delay between cmds

REPEAT NRepeat last command N times

REMComment (ignored)

Pico W / DuckyScript 3.0

ATTACKMODESet attack mode (HID/STORAGE)

LED_R/G/BControl Pico RGB LED

LOCK CAPS_LOCKWait for lock key state

IF / ELSE / END_IFConditional blocks

WHILE / END_WHILELoop blocks

DEFINEDefine a variable

$VARVariable reference

HOLD / RELEASEHold / release a key

Common Combos

GUI rOpen Run dialog (Win)

GUI lLock screen (Win)

CTRL cCopy

CTRL vPaste

CTRL ALT tOpen terminal (Linux)

ALT F4Close active window

Field Manual — DuckyScript IDE Guide

▼

What is the DuckyScript IDE?

This is a development environment for writing, testing, and deploying USB keystroke injection payloads. DuckyScript is the language used by the Hak5 USB Rubber Ducky and compatible devices (Digispark, BadUSB, Pico-Ducky). Payloads automate keyboard input — they type commands as if a human were sitting at the keyboard, but at machine speed.

Two Modes

SIM MODE

Simulates payload execution in the terminal preview. Shows exactly what keystrokes would be injected, what windows would open, and what text would be typed. No real device needed. Click Run to simulate.

LIVE MODE

Deploys the payload to a real USB device registered with Hexworth C2. The device receives the payload via Cloud Functions and executes it on the target machine. Requires admin auth and a registered ducky device.

DuckyScript Quick Reference

REM Comment — not executed, for documentation DELAY 1000 Wait 1000ms (1 second) before next command STRING text Type the text as keyboard input ENTER Press the Enter key GUI r Windows key + R (open Run dialog) CTRL ALT t Ctrl+Alt+T (open terminal on Linux) TAB Press Tab key (autocomplete, next field) REPEAT 5 Repeat the previous command 5 times

Workflow

Write your payload in the editor (or load a template)
Simulate in SIM mode to verify the keystroke sequence
Export as .txt file for manual flashing to a USB Rubber Ducky
Or switch to LIVE and Deploy to Device via C2

Templates

Use the template dropdown in the toolbar to load pre-built payloads. Each template is educational — they demonstrate real-world attack patterns that security professionals need to understand and defend against.

Hello World Opens Notepad, types a message

System Info PowerShell system reconnaissance

WiFi Passwords Dumps saved WiFi credentials

Reverse Shell PowerShell TCP reverse connection

Credential Harvester Fake dialog box social engineering

Rickroll Opens a surprise YouTube video

Security & Ethics

USB injection is a real attack vector used in penetration testing and red team operations
Only use on systems you own or have written authorization to test
Unauthorized use of keystroke injection devices is a federal crime (CFAA)
Understanding the attack is essential for building defenses (USB device policies, endpoint detection)
All payloads in this IDE are educational examples — study them to learn, not to harm

Keyboard Shortcuts

Ctrl+Enter Run simulation Tab Insert 4 spaces (indent)

HEXWORTH PRIME • SIGNAL HOUSE • DUCKYSCRIPT IDE FIELD MANUAL v1.0