NytroRST/NetRipper

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1390 stars · 311 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

NetRipper is a Windows post-exploitation tool that uses API hooking to intercept network traffic, capturing both plain-text and encrypted data before encryption/after decryption. It includes a Metasploit module and is designed for penetration testers with low-privileged access on compromised machines.

Use cases

• sniff network traffic from applications on a compromised Windows machine
• capture encrypted traffic before encryption from low-privileged user context
• capture credentials from tools like Putty, WinSCP, Outlook, Chrome, Firefox
• post-exploitation data gathering via Metasploit module
• search captured traffic for specific strings like user, pass, config
• analyze network activity of a malicious application

When to choose

• you are a penetration tester needing to sniff traffic on a fully patched Windows host with low privileges
• you need to capture encrypted traffic before it is encrypted by hooking crypto APIs
• you want Metasploit integration for post-exploitation workflows

When to avoid

• you need a general-purpose network sniffer like Wireshark or tcpdump
• your target platform is Linux or macOS
• you need actively maintained tooling with recent updates and broad community support

Facets

cli-tool · maturity maintenance

security networking reverse-engineering security penetration-testing windows windows cli traffic-sniffing api-hooking post-exploitation metasploit credential-capture

Member repositories

For agents

markdown · JSON · MCP: product_card(name="NytroRST/NetRipper")