i-am-jakoby/flipper-zero-badusb

★ 6,809PowerShellAudience · researcherComplexity · 2/5Setup · moderate

Mindmap

mindmap
  root((flipper-zero-badusb))
    What it does
      Automate USB keystrokes
      Execute Windows commands
      Security research demos
    Payload types
      Wi-Fi password collection
      Browser history export
      Credential prompts
      Microphone recording
    Tech stack
      PowerShell scripts
      Flipper Zero device
      DuckyScript syntax
    Context
      Educational use
      Security research
      Hak5 community

mindmap root((flipper-zero-badusb)) What it does Automate USB keystrokes Execute Windows commands Security research demos Payload types Wi-Fi password collection Browser history export Credential prompts Microphone recording Tech stack PowerShell scripts Flipper Zero device DuckyScript syntax Context Educational use Security research Hak5 community

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Test how vulnerable a Windows machine is to automated USB keyboard attacks in a controlled security research lab

USE CASE 2

Study how BadUSB payloads are structured to understand USB attack techniques from a defensive security perspective

USE CASE 3

Demonstrate USB security risks during a security awareness training session using a Flipper Zero device

Tech stack

PowerShellFlipper Zero DuckyScript

Getting it running

Difficulty · moderate Time to first run · 30min

Requires a physical Flipper Zero device with the BadUSB app loaded to run these payloads.

In plain English

This repository is a collection of BadUSB payloads written for the Flipper Zero, a small open-source multi-purpose hardware device popular with security researchers and hobbyists. A BadUSB attack works by plugging a device into a computer's USB port. The computer treats it as a keyboard, and the device then types commands automatically and very quickly, faster than a human could. The Flipper Zero can act as a USB keyboard when loaded with these scripts, executing commands on a connected computer without any interaction from its owner. The payloads here are mostly written in PowerShell, a scripting language built into Windows. Each payload is a short script designed to perform a specific action on the target machine. The collection includes scripts that record audio from the microphone and send the transcribed text to a Discord channel, grab saved Wi-Fi passwords and upload them to Dropbox or Discord, collect browser history and bookmarks, record the target's IP addresses, display a map of the target's current location, change the desktop wallpaper, prompt the user to enter credentials which are then sent away, or run jumpscare animations. The author designed most of them to work without any setup beyond loading the file onto the Flipper Zero, by hosting the necessary scripts at a personal short-link domain so that long URLs containing tokens and webhook addresses do not need to be embedded directly in the payload file. The repository is framed as educational content and security research, and the README includes a disclaimer. It was built alongside contributions to the Hak5 payload library, which is a well-known community resource for USB attack research. Usage of these scripts against systems you do not own and have not been given explicit permission to test would be illegal in most jurisdictions.

Copy-paste prompts

Prompt 1

Explain how this Flipper Zero BadUSB payload works step by step so I can understand what a real USB keyboard attack looks like for defensive security training

Prompt 2

I am learning about USB attack surfaces for a security research project. What techniques do the payloads in this repo use and how would a defender detect them?

Prompt 3

How do I load a BadUSB payload onto a Flipper Zero and test it safely in an isolated lab environment I own and control?

Prompt 4

What Windows security settings or endpoint tools can detect or block the types of automated keyboard input these BadUSB scripts perform?

Open on GitHub → Explain another repo

← i-am-jakoby on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.