# Arvanaghi/SessionGopher

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

Repository: https://github.com/Arvanaghi/SessionGopher
Canonical: https://ross.abutalabs.com/products/sessiongopher
Language: PowerShell
License Family: other
Topics: pentesting, red-team, windows, registry, powershell, artifacts
Last push: 2022-11-22T21:33:23+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3465, "days_push": 1380, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1334, forks 170 (observed 2026-08-28T04:04:24.845158+00:00)

## What it is
SessionGopher is a PowerShell tool that extracts and decrypts saved session information for remote access tools like WinSCP, PuTTY, SuperPuTTY, FileZilla, and RDP. It queries the registry via WMI and can run locally or remotely against lists of hosts or entire domains.

## Use cases
- extract saved PuTTY and WinSCP session credentials from Windows hosts
- find systems that connect to jump boxes or Unix servers during a pentest
- remotely harvest saved RDP and FileZilla sessions across a domain
- search drives for .ppk, .rdp, and .sdtid files in thorough mode
- dump saved session passwords from registry hives

## When to choose
- you are doing red-team or post-exploitation work on Windows environments
- you need to map lateral movement paths through saved remote-access sessions
- you want a lightweight PowerShell script with no dependencies that runs via WMI

## When to avoid
- you need a maintained tool with active development or support
- you are not on Windows or cannot run PowerShell
- you need stealth features or evasion capabilities beyond quiet WMI queries

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, cli
- domain: security, penetration-testing, windows, developer-tools
- platform: windows, cli
- tags: powershell, red-team, credential-extraction, wmi, registry, remote-access-tools, post-exploitation

## Member repositories
- Arvanaghi/SessionGopher (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:24.845158+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:44:25.818111+00:00, confidence not recorded.
  - readme: https://github.com/Arvanaghi/SessionGopher (fetched 2026-08-28T04:04:24.845158+00:00, sha aad4f6f56f12)
- Data as of 2026-08-30T08:39:29.467469+00:00.