# GoSecure/pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

Repository: https://github.com/GoSecure/pyrdp
Canonical: https://ross.abutalabs.com/products/pyrdp
Homepage: https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: hacktoberfest, rdp, pentest, honeypot, mitm, pyrdp, security
Last push: 2026-05-13T03:38:53+00:00

## Health v2 (maintenance only)
Score: 60/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 82, release rhythm 8, longevity 100
- inputs: {"age_days": 2917, "days_push": 112, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1780, forks 273 (observed 2026-08-28T04:05:35.415807+00:00)

## What it is
PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library. It intercepts RDP connections to capture credentials, clipboard data, and files, and includes a player for watching sessions live or replaying them later.

## Use cases
- intercept and monitor RDP connections as a man-in-the-middle
- capture plaintext credentials or NetNTLM hashes from RDP logins
- replay recorded RDP sessions or convert them to video
- record and exfiltrate files transferred over RDP or from shared drives
- analyze RDP malware activity in a honeypot
- take covert control of an active RDP session during a pentest
- convert RDP PCAPs into replays or JSON event streams

## When to choose
- you need to inspect, record, or manipulate RDP traffic during a penetration test
- you are building an RDP honeypot to observe threat actors
- you want to replay or convert captured RDP sessions for analysis or evidence

## When to avoid
- you need a general-purpose network proxy or MITM for protocols other than RDP
- you want a defensive RDP gateway rather than an offensive/analysis tool
- you need a polished commercial remote-desktop solution for end users

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, networking, parser
- domain: security, penetration-testing, networking
- platform: python, cli
- tags: rdp, mitm, honeypot, pentest, session-replay, remote-desktop, linux, docker

## Member repositories
- GoSecure/pyrdp (main) score 60

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:35.415807+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:24:26.343500+00:00, confidence not recorded.
  - readme: https://github.com/GoSecure/pyrdp (fetched 2026-08-28T04:05:35.415807+00:00, sha ef6ee7bc8b9e)
  - homepage: https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/ (fetched 2026-08-29T11:03:10.351485+00:00, sha f1f534e05153)
- Data as of 2026-08-30T08:39:29.467469+00:00.