Skip to main content

​
The mission

Your first real Rubber Ducky payload is a classic: open the target computer’s web browser and play “Never Gonna Give You Up” by Rick Astley. This is a harmless prank payload, but it teaches you the exact same workflow used in professional penetration testing:
  1. Write a script that automates keyboard actions
  2. Compile it into a binary the hardware can execute
  3. Deploy it to a target system
The only difference between this RickRoll and a real-world attack payload is what commands you type. The process is identical.
RickRolling has been an internet tradition since 2007. The original “Never Gonna Give You Up” music video has over 1.5 billion views on YouTube - many of them from people who clicked a link expecting something else entirely.

​
The payload

Here is the complete RickRoll payload. Read through it before typing it into PayloadStudio.
That’s it - six lines of actual commands (plus comments). Let’s break down exactly what each line does and why it’s there.

​
Line-by-line walkthrough

REM stands for “remark.” This is a comment - the Rubber Ducky ignores it completely. Comments exist for you, the developer. They explain what the payload does so you (or someone else) can understand the code later.Every payload you write should start with a REM line describing its purpose.
Wait 1000 milliseconds (1 second) before doing anything. This pause is critical.When you plug the Rubber Ducky into a USB port, the computer needs time to:
  • Detect the new USB device
  • Load the HID keyboard driver
  • Register the device as an input source
If the payload starts typing before the computer is ready, keystrokes are lost. One second is usually enough for modern computers, but you may need to increase this to DELAY 2000 on slower machines.
Press Windows + R. This keyboard shortcut opens the Run dialog on Windows - a small text box where you can type commands or URLs.The Run dialog is one of the most useful tools in a Rubber Ducky payload because:
  • It’s available on every Windows computer
  • It accepts URLs (which open in the default browser)
  • It accepts system commands (like cmd, powershell, notepad)
  • It requires no mouse interaction - everything is keyboard-driven
Wait 500 milliseconds (half a second) for the Run dialog to appear on screen. Without this delay, the next STRING command would start typing before the dialog is ready, and the keystrokes would go nowhere - or worse, into whatever application was in focus.Delays between actions are the most common source of payload failures. When in doubt, add more time.
Type the YouTube URL for “Never Gonna Give You Up” into the Run dialog. The STRING command types every character exactly as written - including the ://, the ., and the ?v= parameters.When Windows sees a URL typed into the Run dialog and you press Enter, it opens the URL in your default web browser. This is how the payload gets from “typing text” to “playing a video.”
Press the Enter key. This executes whatever is typed in the Run dialog - in this case, the YouTube URL. The default browser opens and navigates to the video. Rick Astley starts singing.Mission accomplished.

​
Step-by-step deployment

Now that you understand every line, it’s time to build and deploy the payload.
1

Open PayloadStudio

Go to payloadstudio.hak5.org in your web browser. Make sure you’re logged in with your PRO license (see the PayloadStudio setup page if you haven’t activated it yet).
2

Create a new payload

Start with a clean editor. If there’s existing code from a previous session, clear it out.
3

Type the RickRoll payload

Type (or paste) the following code into the editor:
Check for any red error highlights from PayloadStudio PRO. If you see errors, double-check your spelling and formatting.
4

Compile the payload

Click “Generate Payload” (or the compile button). PayloadStudio compiles your DuckyScript into a binary inject.bin file that the Rubber Ducky hardware can execute.
5

Download inject.bin

Download the compiled inject.bin file to your computer. Remember where you saved it - you’ll need to find it in the next step.
6

Connect your Rubber Ducky in arming mode

Plug the USB Rubber Ducky into your computer. It should appear as a removable drive labeled DUCKY. If it starts executing a previous payload instead, press the push button on the device to enter arming mode.
7

Copy inject.bin to the DUCKY drive

Open the DUCKY drive in File Explorer. Copy your downloaded inject.bin file to the root of the drive, replacing any existing inject.bin file.
8

Safely eject the drive

Right-click the DUCKY drive and select Eject. Wait for the “safe to remove” confirmation before unplugging the device. This ensures the file is fully written.
9

Test on your own computer

Open your computer normally. Make sure no important unsaved work is open (the payload will open a browser window). Plug the Rubber Ducky in and watch the magic happen.You should see:
  1. A brief pause (the DELAY 1000)
  2. The Run dialog flashes open
  3. The YouTube URL appears in the Run dialog
  4. Your browser opens to Rick Astley’s masterpiece
If “Never Gonna Give You Up” started playing in your browser, congratulations - you’ve successfully written, compiled, and deployed your first USB Rubber Ducky payload. You are now a DuckyScript developer.

​
Troubleshooting

If your payload didn’t work as expected, check these common issues.
The most likely cause is the initial DELAY was too short. Your computer may need more time to recognize the Rubber Ducky as a keyboard device.Fix: Increase DELAY 1000 to DELAY 2000 or even DELAY 3000. Recompile, reload, and try again.Also check that you typed GUI r (with a lowercase “r”), not GUI R. DuckyScript key modifiers are case-sensitive for letter keys.
DuckyScript assumes a US keyboard layout by default. If your computer uses a different keyboard layout (UK, French, German, etc.), some characters - especially symbols like :, /, ?, and = - may map to different keys.Fix: Make sure your computer’s keyboard layout is set to US English before testing. On Windows, check Settings → Time & Language → Language → Keyboard.
A few things to check:
  1. Did you compile the payload? You need to click “Generate Payload” in PayloadStudio. If you only saved the .txt source file to the Rubber Ducky, it won’t execute.
  2. Is the file named inject.bin? The Rubber Ducky only looks for a file named exactly inject.bin in the root of the microSD card.
  3. Did you eject safely? If you unplugged without ejecting, the file may not have been fully written.
  4. Is the Rubber Ducky in attack mode? If you pressed the button, it may still be in arming mode. Unplug it, wait a moment, and plug it back in without pressing the button.
If the Rubber Ducky is executing a payload (or you need to load a new one), press the push button on the device while it’s plugged in. This switches it from attack mode back to arming mode, where it appears as a flash drive.On some Rubber Ducky models, you may need to hold the button for a second or two.
The STRING command typed the URL, but the browser didn’t launch. This can happen if:
  • The Run dialog wasn’t fully ready when STRING started typing. Fix: Increase DELAY 500 to DELAY 1000.
  • The URL was partially typed into the wrong window. Fix: Make sure no other application grabs focus during the payload. Close unnecessary windows before testing.
  • The computer doesn’t have a default browser set. Fix: Set a default browser in Windows Settings → Apps → Default Apps.

​
Bonus challenges

Finished the RickRoll? Try these modifications to deepen your DuckyScript skills.
Difficulty: BeginnerModify the payload to open a different YouTube video. Find a video you like, copy its URL, and replace the RickRoll URL in your payload.
Replace YOUR_VIDEO_ID_HERE with the actual video ID from the YouTube URL.

​
Understanding the attack workflow

Step back and think about what you just did from a security perspective: The process is the same. The intent is what separates a penetration tester from an attacker. This is why authorization and ethics matter - the tool doesn’t know the difference.
Responsible use reminder: You must only use the USB Rubber Ducky on computers you own or have explicit written permission to test. Unauthorized use is a violation of the Computer Fraud and Abuse Act (CFAA) and can result in criminal charges - even if the payload is “harmless.” A RickRoll on your own computer is a demo. A RickRoll on someone else’s computer without permission is unauthorized access.