# SySS-Research/Seth

Perform a MitM attack and extract clear text credentials from RDP connections

Repository: https://github.com/SySS-Research/Seth
Canonical: https://ross.abutalabs.com/products/seth
Language: Python
License: MIT
License Family: permissive
Topics: rdp, mitm, arp-spoofing, security, proof-of-concept
Last push: 2025-11-20T14:52:49+00:00

## Health v2 (maintenance only)
Score: 56/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 53, release rhythm 35, longevity 100
- inputs: {"age_days": 3463, "days_push": 286, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1454, forks 319 (observed 2026-08-28T04:04:46.702398+00:00)

## What it is
Seth is a Python and Bash proof-of-concept tool that performs a man-in-the-middle attack on RDP connections via ARP spoofing, downgrading the connection to extract clear text credentials. It can also inject keystrokes to execute commands on the RDP host.

## Use cases
- demonstrate RDP downgrade attacks in pentests
- extract clear text credentials from RDP sessions
- perform ARP spoofing MitM against RDP traffic
- inject commands on an RDP host via key press events
- educate about insecure RDP configurations in workshops

## When to choose
- you need a PoC to show RDP credential exposure during an authorized pentest
- you want to demonstrate why RDP connections must be properly configured
- you need to combine an RDP proxy with tools like Responder

## When to avoid
- you need a general-purpose network scanner or full pentest framework
- you require stealthy or production-grade attack tooling
- the target uses keyboard layouts other than English US for keystroke injection
- you lack authorization to test the target network

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, networking, proxy
- domain: security, penetration-testing, networking
- platform: cli, python
- tags: rdp, mitm, arp-spoofing, credential-sniffing, proof-of-concept, pentest, linux

## Member repositories
- SySS-Research/Seth (main) score 56

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:46.702398+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:41.482994+00:00, confidence not recorded.
  - readme: https://github.com/SySS-Research/Seth (fetched 2026-08-28T04:04:46.702398+00:00, sha 4188ca1cf177)
- Data as of 2026-08-30T08:39:29.467469+00:00.