micheloosterhof/cowrie
Cowrie
Cowrie is an SSH and Telnet honeypot that simulates vulnerable services to capture attacker commands, file transfers, and brute force attempts for deception and monitoring. It uses Python-based protocol emulation within a Twisted event-driven network framework to handle concurrent connections, while maintaining an in-memory virtual filesystem that logs every read, write, and traversal operation.
The honeypot distinguishes itself through LLM-driven dynamic response generation, producing context-aware shell replies that adapt to attacker commands rather than relying on static templates. A plugin-based output architecture routes captured events to databases, message queues, or SIEM platforms, while all session activity is serialized into structured JSON logs for later replay and analysis.
The system captures brute force login attempts against both SSH and Telnet services, records files transferred through common tools, and integrates with external threat intelligence feeds to enrich captured artifacts. It also supports traffic proxying to forward connections to a target system while recording all session activity.
Features
- SSH Honeypots - Deploys a fake SSH server to capture attacker login attempts, shell commands, and file transfers.
- Honeypot Shell Emulators - Emulates a full filesystem and shell environment to log attacker commands in a controlled sandbox.
- SSH Brute Force Loggers - Captures every login attempt against SSH and Telnet services, including usernames and passwords.
- SSH and Telnet Server Emulators - Implements custom protocol handlers in Python to mimic SSH and Telnet server behavior.
- Honeypot File System Simulators - Presents attackers with a realistic but isolated directory structure that logs all file access.
- LLM-Powered Shell Response Generators - Integrates large language models to produce context-aware shell responses for honeypot deception.
- LLM-Powered Shell Response Generators - Uses language models to produce realistic, context-aware replies to attacker commands.
- In-Memory Filesystems - Maintains a simulated UNIX filesystem as an in-memory tree structure that logs all operations.
- Honeypot File Transfer Capturers - Records files downloaded or uploaded through common transfer tools for later inspection.
- Session Recording Proxies - Forwards SSH and Telnet connections to a target system while recording all session activity for analysis.
- Structured JSON Logging - Serializes all attacker commands, outputs, and file transfers into structured JSON logs for replay.
- Plugin-Based Architectures - Routes captured events through a pluggable output system to databases, message queues, or SIEM platforms.
- Attacker Shell Command Loggers - Logs every command an attacker executes after gaining shell access to preserve the full session.
- Honeypot Systems - SSH honeypot designed to capture brute-force attacks.
- Testing and Honeypots - Advanced SSH honeypot based on previous implementations.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
