Lion Cipher Lab
Decode a BadUSB keystroke-injection payload — then lock down USB with USBGuard
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A USB stick can lie about what it is. Instead of a flash drive, it announces itself to the OS as a keyboard — a Human Interface Device (HID) — and 'types' commands the instant it's plugged in. This is 'BadUSB' (Rubber Ducky). It defeats every 'don't run files off a USB stick' rule, because the OS trusts keyboards implicitly: there is no 'do you allow this keyboard?' prompt. Understanding the attack by decoding a payload you wrote — and then defending with device authorization — is core endpoint-hardening judgment. It's also a clean lesson in defense-in-depth: the fix isn't blocking storage,…
What you'll learn
- understanding the BadUSB / HID-injection threat model
- reading DuckyScript (DELAY / STRING / GUI r / ENTER)
- encoding a payload to inject.bin and decoding it back to keystrokes
- mapping raw inject.bin bytes to USB HID usage codes and modifiers
- explaining why the OS implicitly trusts a keyboard
- installing USBGuard and generating an allowlist policy
- flipping USB from implicit-allow to default-block
- authorizing and blocking a device by rule
- judging when device-authorization is worth the usability friction
Steps in this lab
- The threat: a USB stick that pretends to be a keyboard
- DuckyScript: the human-readable HID-injection language
- Write a BENIGN demo payload
- Encode it to inject.bin
- Decode it: read inject.bin back to raw keystrokes
- Install USBGuard and snapshot what's already attached
- The fix: flip from implicit-allow to default-block
- Judgment: when this friction is worth it, and the Windows equivalent