Cowrie – SSH/Telnet Honeypot

Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. This is an updated version of kippo where it will have some additional features to monitor any compromised or infected system.

Cowrie - SSH/Telnet Honeypot
Cowrie – SSH/Telnet Honeypot

Some of the interesting features:

  • Fake filesystem with the ability to add / remove files. A full fake filesystem resembling a Debian 5.0 installation is included.
  • Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
  • Session logs are stored in an UML Compatible format for easy replay with original timings with the bin/playlog utility.
  • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection log

Additional functionality over standard kippo:

  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
  • Logging in JSON format for easy processing in log management solutions
  • Many, many additional commands

This tool may help in detecting bruteforce attack or in case there is an infected machine with a worm that is spreading over the network.

You can read more and download this tool over here:

Notify of
Inline Feedbacks
View all comments