> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/bash-bunny/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/bash-bunny/writing-payloads/quack.md).

# QUACK

The Bash Bunny inherits the original DuckyScript commands from the USB Rubber Ducky. Keystrokes can be injected from DuckyScript text files, or inline using the `QUACK` command. The `ATTACKMODE` must contain `HID` for keystroke injection.

**Examples**:

```
QUACK switch1/helloworld.txt
```

Injects keystrokes from the specified ducky script text file.

```
QUACK STRING Hello World
```

Injects the keystrokes “Hello World”

```
Q ALT F4
```

Injects the keystroke combination of ALT and F4

### ALT CODES

Firmware version 1.5 added the `QUACK ALTCODE` command. This allows the printing of alt-codes on Windows system only.

```
QUACK ALTCODE 168 # types an upside down question mark
QUACK ALTCODE 236 # types an infinity symbol
```

### Caveats

**When writing payloads for the bash bunny be mindful that when using `QUACK` and other DuckyScript commands you are&#x20;*****passing arguments to a script.*** \
\
If you are using variables in your payload, and injecting keystrokes, avoid variable naming collisions!\
\
`URL="example.com"`\
`QUACK STRING <some code we are injecting onto a system> $URL` \
Will inject:\
`<some code we are injecting onto a system> example.com`\
\
**This can be very useful for adding easily configurable parameters to your payload for others to use similar to the** [`DEFINE`pattern introduced in DuckyScript 3 on the USB Rubber Ducky](https://docs.hak5.org/hak5-usb-rubber-ducky/attack-modes-constants-and-variables/constants#define). However, if the code you're intending to inject on a system uses a variable `$URL` (and so does your *bash bunny payload*) you will **not get the intended results** because bash will have **resolved it** *rather than injecting it.*\
\
You may find that there may be other, similar caveats when building complex payloads with the power of Bash+DuckyScript.
