Blog

PILFERING PASSWORDS WITH THE USB RUBBER DUCKY Can you social engineer your target into plugging in a USB drive? How about distracting ’em for the briefest of moments? 15 seconds of physical access and aUSB Rubber Ducky is all it takes to swipe passwords from an unattended PC.

Using a USB Rubber Ducky and this simple payload, Windows password hashes can be captured for cracking in less than two seconds. This technique works against almost all versions of Microsoft Windows and only requires a 5 line Ducky Script and an open source server setup on the target network.