$ show FalsePhilosopher/badusb
This repository is a community-driven collection of DuckyScript payloads designed for USB Rubber Ducky, Flipper Zero, and other HID attack devices. It primarily functions as a playbook for penetration testers and red teamers, offering ready-to-inject scripts that automate keystroke injection attacks. The codebase is organized into a flat file tree by platform (Windows, Linux, macOS, mobile) and category (credentials, remote_access, destructive, prank, exfiltration, recon, execution, etc.). Each payload is a self-contained DuckyScript file, often embedding PowerShell, Bash, or Python one-liners that are typed and executed on the target machine. The repository includes hundreds of payloads covering credential theft (e.g., browser password dumping, WiFi key extraction), remote access (reverse shells, persistence via systemd, scheduled tasks), destructive actions (fork bombs, zip bombs, file corruption), exfiltration (webhook, Dropbox, email), and pranks (RickRolls, fake updates, desktop trolling). The architecture is not a traditional application but a script library; the 'code' is primarily configuration/scripting rather than compiled software. Maintenance is active, with monthly snapshot tags and contributions, though many payloads suffer from hardcoded URLs and dependencies on specific OS versions, leading to moderate technical drift. The repository does not contain data pipelines, notebooks, or ML models.
The LLM identified 3 files worth highlighting for reuse:
A standalone Bash script for managing command-and-control targets. It allows creating, listing, removing, and connecting to remote targets via netcat, with built-in persistence via systemd user services. This component is reusable as a lightweight C2 manager that can be adapted for any Linux penetration testing scenario requiring target management.
A PowerShell script that extracts browser bookmarks from Chrome and Firefox and exfiltrates them to Dropbox via the Dropbox API. It is self-contained, handles multiple browsers, and can be easily modified for different exfiltration endpoints. Useful as a template for credential harvesting or reconnaissance scripts.
A DuckyScript payload that sets up a local web server backdoor on a Raspberry Pi (Quackberry). It includes a Python script that listens for incoming connections and provides a shell. The payload is self-contained with instructions and can be reused for any Linux device to create a stealthy remote access point.