WiFiDuck
A wireless keystroke injection attack platform that emulates a USB keyboard and is managed via WiFi.
What is WiFiDuck?
WiFi Duck is an open-source platform that performs keystroke injection attacks by emulating a USB keyboard. It allows users to remotely send automated keystroke sequences to a target computer via WiFi, demonstrating the security risks of trusted USB devices. The project includes both hardware and software components, supporting DIY builds or pre-assembled devices.
Security researchers, penetration testers, and educators who want to learn about or demonstrate BadUSB attacks and USB-based vulnerabilities in a controlled environment.
Unlike traditional BadUSB tools, WiFi Duck offers wireless management through a web interface, eliminating the need for physical media or installed software. Its open-source nature and hardware flexibility make it accessible for customization and educational use.
Overview
Wireless keystroke injection attack platform
Use Cases
Best For
- Learning about BadUSB attacks and keystroke injection techniques
- Conducting authorized penetration tests on USB security
- Building custom wireless keystroke injection devices
- Educational demonstrations of USB-based vulnerabilities
- Automating repetitive keyboard tasks for testing purposes
- Developing and testing Ducky Script payloads in a wireless environment
Not Ideal For
- Large-scale penetration testing operations requiring device management or integration with professional frameworks
- Covert security assessments where default WiFi credentials (SSID 'wifiduck', password 'wifiduck') could raise alarms
- Dynamic, interactive attacks needing real-time keyboard feedback or immediate script adjustments
- Users lacking hardware soldering skills or experience with microcontroller programming and flashing
Pros & Cons
Pros
Offers wireless control via a built-in web server over WiFi, allowing script management without physical access or additional software, as highlighted in the web-based interface feature.
Uses the industry-standard Ducky Script language from Hak5, enabling easy adoption of existing scripts and resources for keystroke injection, as noted in the scripting basics section.
Supports DIY builds with common boards like Atmega32u4 and ESP8266, or pre-assembled options like Malduino W, providing versatility for different user needs, as detailed in the hardware sections.
Allows firmware updates via WiFi without physical reflashing, improving maintainability and ease of use, mentioned in the flash software section for ESP8266.
Cons
Requires soldering, precise pin connections between two microcontrollers, and separate flashing processes, which can be error-prone and time-consuming, as admitted in the DIY hardware and flash software sections.
Focused solely on keystroke injection via USB emulation, lacking support for other USB-based attacks like storage emulation or HID spoofing, which limits its scope compared to broader security tools.
Adding new keyboard layouts involves manual coding, testing, and modifying source files, as described in the translate keyboard layout section, which can be daunting for non-developers.
Frequently Asked Questions
Related Projects
ESP8266 DeautherAffordable WiFi hacking platform for testing and learning
ESP32MarauderA suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
ESP8266 Beacon SpamCreates up to a thousand WiFi access points with custom SSIDs.
DeauthDetectorDetect deauthentication frames using an ESP8266
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.