Open-Source USB Rubber Ducky Setup (T-Dongle S3)

This lesson introduces one of the most well-known tools in security education: the USB Rubber Ducky, here as the open-source T-Dongle S3 running USB Army Knife firmware. It looks like a normal USB stick but acts as an HID injector, a device that pretends to be a keyboard and types commands. You will learn how HID injection works, why it is possible, how to defend against it, and you will flash the firmware and run a harmless demo, only on your own device.

What HID injection is and why it works

HID stands for human interface device, meaning keyboards and mice. The key insight is that computers implicitly trust them: plug in a keyboard and the system lets it type anything, with no special driver and on nearly any machine. An HID injector like the T-Dongle exploits exactly that trust. It looks like a USB stick but identifies itself as a keyboard and types out a pre-written script far faster than a human could. Understanding this trust relationship is the whole point, because it is also the key to defending against it.

The T-Dongle S3 and USB Army Knife firmware

This is not a name-brand Rubber Ducky; it is an open-source equivalent built on a T-Dongle S3, which has a small screen, an SD card slot, a reset button, and a Wi-Fi-capable ESP32 chip. The USB Army Knife firmware turns it into a scriptable HID device: you write flexible scripts similar to DuckyScript, and the Wi-Fi and SD storage add capabilities beyond a basic keyboard emulator. You store scripts on a FAT32-formatted SD card and manage them through a web interface the device hosts.

Flashing the firmware

There are two ways to load the firmware. The easy way is a browser-based web installer: connect the device and follow the prompts, no software or coding needed. The manual way uses a web-based ESP flashing tool where you place the bootloader, partition, firmware, and boot files at their specific memory addresses. To enter flashing mode you hold the reset button while plugging the device in. After flashing, the device hosts a Wi-Fi access point and a web page where you write and launch scripts.

A harmless demo, on your own machine only

The first payload is deliberately benign: it opens Notepad and types a message. You write it in the web interface, plug the dongle into your own computer (or one you have explicit permission to test), and watch it open the app and type on its own. This demonstrates the mechanism safely. The same technique could be misused, which is exactly why the rule is absolute: your own device, or explicit permission, always.

Defending against it

Because this trusts the keyboard, the defenses are about the port and the device. Do not plug unknown USB devices into your machines; that stray stick in the parking lot is the classic delivery method. On systems that matter, use device controls that restrict which USB devices can act as keyboards, lock the screen when you step away, and be suspicious of any device that starts typing on its own. Knowing how the attack works is what makes these defenses obvious.

Working through it

Inspect the device. Note the T-Dongle S3's screen, SD card slot, reset button, and ESP32. Format a spare SD card as FAT32 with an MBR partition for your scripts, keeping last month's card free.

Flash the firmware. Use the browser web installer for the easy path, or the manual ESP web tool placing each bin file at its address. To enter flash mode, hold the reset button while plugging the device in.

Reach the web interface. After flashing, connect to the device's Wi-Fi access point with the provided password, then open its web page to manage and launch scripts.

Write a harmless demo. Create a script that opens Notepad and types a friendly message, using delays so a slower machine can keep up.

Test on your own device. Plug the dongle into your own computer and watch it open Notepad and type. Only ever do this on a device you own or are explicitly permitted to test.

A harmless demo payload (opens Notepad and types)

REM Benign demo: opens Notepad and types a message.
REM Run ONLY on your own device or with explicit permission.

GUI r                 REM open the Run dialog (Windows key + R)
DELAY 1000            REM wait for it to appear
STRING notepad        REM type the app name
ENTER
DELAY 1000            REM wait for Notepad to open
STRING Hello from CraftingTable Academy
ENTER

Each line is a keyboard action the dongle performs: open the Run dialog, launch Notepad, and type a message. The delays give the computer time to respond. Nothing here is harmful; it simply demonstrates how fast an HID device can act. USB Army Knife syntax may differ slightly from classic DuckyScript, so adjust if a command does not run.