EvilDuck S3 V2 USB Rubber Ducky Device Plug and Play Penetration Testing Security Audit Tool for Windows Linux Mac System Audit

Overview

EvilDuck is a custom USB rubber ducky — a device that plugs into any computer and acts as a keyboard, executing pre-written payloads automatically. It's inspired by WiFiDuck by Spacehuhn, which pairs an ESP8266 for WiFi with an ATmega32U4 for USB HID. EvilDuck takes that concept and builds on it with each hardware revision. EvilDuck S3 The second generation. Built around the ESP32-S3, which handles both USB HID and WiFi natively on a single chip — no second microcontroller needed. The result is a more compact, more capable, fully self-contained device. It adds a browser-based control panel over WiFi, SD card support for expanded storage, an addressable RGB LED, and a full DuckScript interpreter — all while staying the same physical size. What's New - Single-chip design — ESP32-S3 replaces the ATmega32U4 + ESP8266 combo - WiFi access point — browser-based control panel, no app required - Addressable RGB LED — WS2812 (2020 package), fully color-controllable in software - SD card support with expanded storage and USB mass storage mode - Over-the-air firmware updates via the web interface - DuckScript interpreter — executes scripts line by line as USB HID keystrokes - Autorun — plug in and a chosen script starts automatically - Stealth mode — adjusts timing and LED behavior Hardware - Microcontroller: ESP32-S3 - WiFi: Built-in (802.11 b/g/n) - USB: Native USB HID (no second MCU) - Storage: Internal SPIFFS + MicroSD - RGB LED: WS2812 (2020 package) - Voltage Regulator: LM1117 (5V → 3.3V) - Connector: USB Type-A Web Interface (accessible over WiFi once the device is powered) - Upload, edit, save, and delete scripts - Trigger payloads remotely - Live execution status (current script + line number) - Execution log with warnings and errors - Stop a running script mid-execution - Send individual commands for quick testing - Built-in script library (Windows, Linux, macOS, demos, advanced) - Password-protected with optional hidden SSID - Configurable network name, password, and channel Storage Modes - Internal flash (SPIFFS) — persistent across reboots - SD card — expanded storage, file transfer between internal and SD - USB mass storage mode — drag and drop files directly

Features

• USB HID keyboard injection — plug & play on Windows/Linux/macOS
• DuckyScript payload support (WiFiDuck compatible)
• Wi-Fi web interface for live payload delivery from phone/laptop
• ESP32-S3 core with onboard storage for multiple payloads
• Compact stealth form factor for red-team engagements

Specifications

Chipset

ESP32-S3

Control

Wi-Fi web UI

Payloads

DuckyScript / WiFiDuck

Interface

USB-A (HID keyboard)

OS Support

Windows, Linux, macOS