Password Attacks

Cowrie – SSH Honeypot

Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
Cowrie is directly based on Kippo by Upi Tamminen (desaster).
Some interesting features:
  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can ‘cat’ files such as /etc/passwd. Only minimal file contents are included
  • Session logs stored in an UML Compatible format for easy replay with original timings
  • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection
Additional functionality over standard kippo:
  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Logging in JSON format for easy processing in log management solutions
  • Many, many additional commands
Cowrie – SSH Honeypot Requirements
  • An operating system (tested on Debian, CentOS, FreeBSD and Windows 7)
  • Python 2.5+
  • Twisted 8.0+
  • PyCrypto
  • pyasn1
  • Zope Interface
Files of interest:
  • dl/ – files downloaded with wget are stored here
  • log/cowrie.log – log/debug output
  • log/cowrie.json – transaction output in JSON format
  • log/tty/ – session logs
  • utils/ – utility to replay session logs
  • utils/ – used to create fs.pickle
  • data/fs.pickle – fake filesystem
  • honeyfs/ – file contents for the fake filesystem – feel free to copy a real system here


Download at Github Repo:

I started blogging around 2011 at #Ubuntupirates, #ProjectX and #pir8geek, I’m currently working as Network/Linux SysAdmin.

I’m a Linux,opensource advocate and interested in network security and InfoSec.

Leave a Reply