By CyberRogue | ethical Hackers Den

If you've spent any time messing around with BadUSBs, Digisparks, or even configuring headless setups on a Raspberry Pi Zero 2 W, you know the power of Keystroke Injection. Writing out payloads line-by-line can get tedious, especially when you are trying to perfect the timing of your delays.

To make life a little easier for the community, I've just published a brand new tool right here on the site: The Interactive Ducky Script Generator.

Instead of writing raw text, this tool lets you build your payloads visually. You select your commands, type your strings, and it compiles the raw Ducky Script syntax for you in real-time. Today, I want to pull back the curtain and show you exactly how this tool works under the hood using standard HTML, CSS, and Vanilla JavaScript.

Let's break down the code!

---

1. The Brains of the Operation: State Management

At its core, the generator doesn't rely on any complex frameworks or external databases. The entire sequence is managed by a single, simple JavaScript array.

// This array acts as the single source of truth for our payload sequence
let duckyScript = [];

2. Capturing the Input

When you select a command like STRING from the dropdown, type "Hello World", and hit Add to Script, we need to grab those values and push them to our array. Here is the exact function handling that logic:

function addDuckyCommand() {
  // Grab the HTML elements
  const cmdSelect = document.getElementById('duckyCommand');
  const valInput = document.getElementById('duckyValue');
  
  // Extract the values
  const cmd = cmdSelect.value;
  const val = valInput.value.trim();

  // If a command exists, push it to our sequence array
  if (cmd) {
    duckyScript.push({ cmd, val });
    
    // Clear the input field for the next command
    valInput.value = ''; 
    
    // Trigger the UI to refresh
    updateDuckyUI();
  }
}

3. Rendering the Raw Output

The magic happens in the updateDuckyUI() function. Every time the array changes (an item is added, deleted, or a template is loaded), this function wipes the slate clean and rebuilds the visual list and the raw text output.

Here is the snippet that actually formats your array into valid Ducky Script syntax:

let rawText = '';

// Loop through our array of commands
duckyScript.forEach((item, index) => {
  // If the command has a value (like STRING hello), print both.
  // If it doesn't (like ENTER), just print the command.
  const line = item.val ? `${item.cmd} ${item.val}` : item.cmd;
  
  // Append it to our raw text string with a line break
  rawText += line + '\n';
});

// Push the compiled text to the read-only textarea
document.getElementById('duckyRawOutput').value = rawText.trim();

4. Built-In Templates for Quick Starts

If you are new to Ducky Script, starting from a blank page can be intimidating. I wanted to include a few classic examples to demonstrate how commands like GUI and DELAY work together.

I set these up as pre-defined arrays. When you click the "Rick Roll" or "Hello World" template buttons, the tool simply deep-copies the template array into our main duckyScript array and refreshes the screen.

const templates = {
  rickroll: [
    { cmd: 'GUI', val: 'r' },
    { cmd: 'DELAY', val: '500' },
    { cmd: 'STRING', val: 'https://www.youtube.com/watch?v=dQw4w9WgXcQ' },
    { cmd: 'ENTER', val: '' }
  ]
};

function loadDuckyTemplate(templateName) {
  if (templates[templateName]) {
    // Deep copy the array so we don't accidentally modify the master template
    duckyScript = JSON.parse(JSON.stringify(templates[templateName]));
    updateDuckyUI();
  }
}

---

Try It Out!

The beauty of this generator is that it runs entirely on the client side. It’s fast, lightweight, and keeps your payload data entirely in your own browser—nothing is ever sent back to a server.

Head over to the Ducky Script Generator and start building your custom automation tools and test payloads.

Once you build something cool, drop a comment below and let me know what hardware you're deploying it on!