Have you ever wondered how easy it is to build your own DIY USB keylogger from scratch? Using widely available and affordable hardware (under $10), you can create a powerful, Wi-Fi-enabled keystroke logger.
Enter DuckLogger, an ESP32-S3–based USB keylogger written in MicroPython. It not only logs keystrokes directly to its internal flash storage but also provides a built-in Wi-Fi access point and a sleek Web Command & Control center.
⚠️ WARNING: For Educational Purposes Only.
This tutorial and the DuckLogger project are intended strictly for educational use, cybersecurity research, and ethical hacking. Unauthorized interception of communications or keystrokes on devices you do not own or have explicit permission to test is illegal.
In this guide, we'll walk you through exactly how to build and configure your own DIY USB keylogger using DuckLogger.
What Makes DuckLogger Stand Out?
Creating a custom PCB isn't necessary for this build. Using cheap, off-the-shelf components, DuckLogger brings a ton of features:
- Keystroke Logging: Stealthily records keystrokes to a local log file.
- Dual Wi-Fi Modes: Acts as its own Hotspot (Access Point mode) or connects to an existing network (Station mode).
- Remote DuckyScript Injection: Inject and execute standard DuckyScript payloads remotely.
- Web Command & Control Center: Easily manage logs, inject payloads, and control device settings wirelessly.
- Remote Live Keyboard: Attach a virtual keyboard and send real-time keystrokes via WebSockets with near-zero latency.
Here is a look at the DuckLogger Web Command and Control Center:
(You can easily download logs, use the live keyboard, and update network settings from the web UI)
Hardware Requirements
To build this ESP32-S3 keylogger, you will need:
- ESP32-S3 SuperMini (The brain and Wi-Fi interface)
- CH9350 HID Module (Converts USB keyboard inputs into serial data)
- 4 Female-to-Female Jumper Wires
- A USB-C cable for flashing and power.
Getting Started: Step-by-Step Guide
1. Wiring and Schematics
The wiring is incredibly straightforward. We need to connect power, ground, and UART lines between the ESP32-S3 and the CH9350.
Pin Connections:
| ESP32-S3 | CH9350 |
|---|---|
| 5V | 5V |
| GND | GND |
| GP1 | TX |
| GP2 | RX |
2. Configure the CH9350 DIP Switches
The CH9350 module has multiple operating modes controlled by onboard DIP switches.
To enable USB Host Mode (which reads keyboard inputs and outputs serial data):
- Set switch S0 to the GND position (0).
- Keep all other switches in the opposite position (1).
3. Flash MicroPython
Because DuckLogger is powered by MicroPython, you need to flash your ESP32-S3 SuperMini first.
- Download the correct firmware from the MicroPython ESP32-S3 Downloads page.
- Flash the firmware to your board.
- Disconnect and reconnect the board via USB to ensure a fresh boot.
4. Install the DuckLogger Software
Next, let's clone the DuckLogger repository and flash the code to the board.
# Clone the repository
git clone https://github.com/Itsmmdoha/duckLogger.git
cd duckLogger
# Run the flasher script (Ensure your board is connected!)
python flasher.py
The provided flasher.py script makes installation a breeze. It installs mpremote, sets up the necessary MicroPython packages, compresses the web interface UI (index.html), copies the files, and automatically reboots the ESP32-S3.
Using Your DIY USB Keylogger
Once everything is wired and flashed, deployment is simple:
- Plug the target USB keyboard into the CH9350 HID module.
- Connect the ESP32-S3 SuperMini to the target PC using a USB cable.
What happens next?
The device immediately starts acting as a pass-through, logging all keystrokes. It also boots up a hidden Wi-Fi Access Point (SSID: ducklogger / Default Password: duckPass1234).
Connect to the network with your phone or laptop and navigate to:
http://192.168.4.1/
You now have full wireless access to the command center to view logs or trigger DuckyScript injections (like STRING Hello World or GUI r).
Conclusion
Building a DIY Wi-Fi keylogger with an ESP32-S3 is an incredible weekend project to understand hardware-based keystroke interception, UART communication, and IoT web servers. Check out the full source code and support the project on the DuckLogger GitHub Repository.
Stay safe, hack ethically, and happy making!
