|travis|_ |circleci|_ |codecov|_
Welcome to the Cowrie GitHub repository
This is the official repository for the Cowrie SSH and Telnet Honeypot effort.
What is Cowrie
Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.
Cowrie <http://github.com/cowrie/cowrie/>_ is maintained by Michel Oosterhof.
The Documentation can be found
You can join the Cowrie community at the following
Slack workspace <https://www.cowrie.org/slack/>_.
Choose to run as an emulated shell (default):
catfiles such as
/etc/passwd. Only minimal file contents are included
Or proxy SSH and telnet to another system
For both settings:
UML Compatible <http://user-mode-linux.sourceforge.net/>_ format for easy replay with the
Docker versions are available.
To get started quickly and give Cowrie a try, run::
$ docker run -p 2222:2222 cowrie/cowrie $ ssh -p 2222 [email protected]
On Docker Hub: https://hub.docker.com/r/cowrie/cowrie
Or get the Dockerfile directly at https://github.com/cowrie/docker-cowrie
For Python dependencies, see
Files of interest:
etc/cowrie.cfg- Cowrie's configuration file. Default values can be found in
share/cowrie/fs.pickle- fake filesystem
etc/userdb.txt- credentials to access the honeypot
honeyfs/ <https://github.com/cowrie/cowrie/tree/master/honeyfs>_ - file contents for the fake filesystem - feel free to copy a real system here or use
honeyfs/etc/issue.net- pre-login banner
honeyfs/etc/motd <https://github.com/cowrie/cowrie/blob/master/honeyfs/etc/issue>_ - post-login banner
var/log/cowrie/cowrie.json- transaction output in JSON format
var/log/cowrie/cowrie.log- log/debug output
var/lib/cowrie/tty/- session logs, replayable with the
var/lib/cowrie/downloads/- files transferred from the attacker to the honeypot are stored here
share/cowrie/txtcmds/ <https://github.com/cowrie/cowrie/tree/master/share/cowrie/txtcmds>_ - file contents for simple fake commands
bin/createfs <https://github.com/cowrie/cowrie/blob/master/bin/createfs>_ - used to create the fake filesystem
bin/playlog <https://github.com/cowrie/cowrie/blob/master/bin/playlog>_ - utility to replay session logs
Cowrie will by default upload data on crashes and Python exceptions to api.cowrie.org. This information is used to improve the honeypot and is not shared with third parties. It can be disabled by setting
Many people have contributed to Cowrie over the years. Special thanks to:
.. |travis| image:: https://travis-ci.com/cowrie/cowrie.svg?branch=master .. _travis: https://travis-ci.com/cowrie/cowrie
.. |circleci| image:: https://circleci.com/gh/cowrie/cowrie.svg?style=svg .. _circleci: https://circleci.com/gh/cowrie/cowrie
.. |codecov| image:: https://codecov.io/gh/cowrie/cowrie/branch/master/graph/badge.svg .. _codecov: https://codecov.io/gh/cowrie/cowrie