A free, open source platform for building and deploying USB / HID payloads. Includes a web UI for payload browsing, device flashing, SnarfSnarf exfil generation, lure building, and phone-home catch.
Modern web rebuild of The Skeleton Key (2018 TUI lineage). GitHub repo: neur0sp1cy/TSK.
By Neur0Sp1cy
Contact: [email protected] - questions, concerns, and comments.
Special thanks to derv82 for early testing and feedback.
TSK is for authorized security testing only - private labs, VMs you control, or environments where you have written permission to deploy payloads and run assessments.
Do not use this project against systems you do not own or lack authorization to test. Misuse, harassment, and illegal activity are not supported and are solely your responsibility.
Full policy: SECURITY.md (authorized use, vulnerability reporting, disclaimer).
- Web UI - Browse HAK5 payload repos, preview, edit, and flash to supported devices; collapsible categories and package accordions with persisted expand state
- USB Dropper - Build exfil scripts (PowerShell / Bash), lure packages (LNK, README,
.desktop), flash to a plain USB stick - SnarfSnarf (SNARF modal) - Visual exfil builder with phone-home or on-stick output; saved scripts appear under EXFILS, lure packages under LURES, hand-authored files under MY PAYLOADS (
+ NEW) - CATCH - Live receiver for phone-home uploads with preview and ZIP export
- LAN Turtle - SSH terminal in the browser
- Themes - Six UI themes (default through flat);
theme <name>in command bar - Tutorial - In-app missions at
/tutorial
Operator console · default theme · authorized lab use only
Payload browse - HAK5 libraries, expand/collapse categories, live preview, flash controls
SNARF - visual exfil builder · targets, format, LHOST/LPORT |
CATCH - live phone-home uploads · preview · ZIP export |
USB flash - scan a plain stick, substitute LHOST/LPORT, deploy exfil or lure packages
CONFIG - LHOST/LPORT, tools, device mount paths |
About - repo, phone-home, and support links |
Tutorial - seven guided missions at /tutorial (or press H → Open Tutorial)
See TESTING.md for lab setup and step-by-step USB test scenarios.
Pre-release checklist: RELEASE_ROADMAP.md (timeline, polish, go-live).
Release notes: CHANGELOG.md
Full feature checklist: TESTING_CHECKLIST.md (pass/fail every feature before release).
| Requirement | Notes |
|---|---|
| Python 3.8+ | 3.10+ recommended |
| uv | Recommended for dependency install |
| Plain USB flash drive | FAT32 or exFAT, writable (not a Bunny/Ducky volume) |
| Same LAN | Required for phone-home; victim must reach LHOST:LPORT (default 1337) |
| java | Rubber Ducky encoding only |
| ssh | LAN Turtle operations only |
Dependencies install automatically via uv sync (FastAPI, uvicorn, bcrypt, jinja2, pylnk3, paramiko).
curl -LsSf https://astral.sh/uv/install.sh | sh
git clone https://github.com/neur0sp1cy/TSK
cd TSK
uv sync
uv run python server.pyOpen http://127.0.0.1:1337 in your browser (or run ./run_web.sh on Linux).
Fun commands (command bar): quote · joke · hack the planet · defcon · play/pause/next (drop tracks in web/static/music/) · present for demo layout. Press H for the full list.
To enable HTTPS (recommended when accessing from other LAN machines):
uv run python server.py --sslA self-signed cert is generated once at ssl/tsk.crt and reused on every restart. Your browser will show a security warning on first visit - click Advanced then Proceed to accept it. Phone-home snarf scripts use plain HTTP and are unaffected.
git clone https://github.com/neur0sp1cy/TSK
cd TSK
uv sync
uv run python server.py
# or: uv run python server.py --ssl- Click NEW on the login screen and register an operator (password min 8 characters).
- Open CONFIG (C tile under SYSTEM) and set LHOST to your LAN IP (use the LAN IP helper).
- Set LPORT to
1337unless you changed the server port. - Optional: open /tutorial for Mission 1 walkthrough, or press H and click OPEN TUTORIAL.
Per-operator config: users/<operator>/config.json
Saved USB payloads: users/<operator>/payloads/usb/ (exfil scripts, packages/<slug>/ lure bundles)
Cloned repos: repos/
Phone-home uploads: snarfed/<operator>/ (isolated per operator)
Session auth: register/login required; API uses X-TSK-Token header. Password min 8 characters.
| Area | Purpose |
|---|---|
| Left nav | SYSTEM tiles (About, Help, Config, Repos, Operator) + DEVICES cards |
| Center | Payload list for selected device (expand/collapse categories and packages); USB shows + NEW, SNARF, and LHOST chip in header |
| Modals | CONFIG, REPOS, OPERATOR, SNARF (USB), About, Help |
| Right panel | Preview, USB stick scan, FLASH / EDIT / SAVE |
| Bottom bar | Command line (set lhost, clone ducky, devices, …) |
| H | Help modal (operator guide) |
| A | About modal |
| Key | Action |
|---|---|
D B U L |
Jump to device (Ducky, Bunny, USB, Turtle) |
C R O A H |
Config, Repos, Operator, About, Help |
S |
SNARF builder (USB Dropper only) |
f / Ctrl+Enter |
Flash |
e |
Edit payload |
Esc |
Close modals |
| Device | Flash method |
|---|---|
| USB Dropper | Web UI: scripts and lure packages to a plain USB stick |
| Rubber Ducky (OG) | encoder.jar → SD card |
| Bash Bunny (OG) | Mass storage → switch1 / switch2 |
| LAN Turtle (OG) | SSH/SCP push |
| Teensy 3.2 / 4.0 | teensy_loader_cli with compiled .hex (sidebar shows when built-in sketch is present; flash needs .hex beside .ino) |
Clone HAK5 libraries from the REPOS modal (sidebar R): clone ducky, clone bunny, clone turtle, clone all.
TSK/
├── server.py # Web server (start here)
├── web/index.html # Web UI
├── web/tutorial.html # In-app tutorial missions
├── web/static/ # Icons, branding, music drop folder
├── dropper/ # SnarfSnarf, lure builder, receiver
├── flash.py # Flash engine
├── config.py # Auth and per-operator config
├── repos.py # Repo clone and indexing
├── users/ # Operator data
├── repos/ # Cloned payload libraries
├── snarfed/ # Phone-home catches (per-operator subdirs)
├── TESTING.md # Lab testing guide
├── TESTING_CHECKLIST.md
├── RELEASE_ROADMAP.md
├── SECURITY.md # Authorized use and disclosure
├── archive/tui/ # Archived TUI notes (removed; web UI only)
└── pyproject.toml
TSK is free and open source. If it helps in the field, a coffee keeps the lights on in Night City.
Every donation goes back into hardware and development. No paywalls, ever.
- Bugs: GitHub Issues (use the bug report template)
- Repro help: TESTING_CHECKLIST.md - cite the section you are on
- Security issues in TSK: see SECURITY.md (responsible disclosure, not public issues for exploit details)
- Questions / concerns: [email protected]
- Expectations: best-effort support; be constructive - we squash bugs, not tolerate abuse
Enable Issues: On GitHub, open neur0sp1cy/TSK → Settings → General → Features → enable Issues → Save. New issues will use the bug report template in .github/ISSUE_TEMPLATE/.
Dreamed up under the wet hot neon lights of Las Vegas.