Cowrie
Medium to high interaction SSH and Telnet honeypot that records attacker sessions.
Technical Architecture & Overview
Cowrie imitates an SSH and Telnet server, accepting connections, logging credentials used by brute-force attempts, and optionally letting attackers into a emulated shell where commands, files, and downloads are recorded. Its logs feed research, threat intelligence, and detection work, and it is one of the most widely deployed SSH honeypots. An active community maintains the project under the Cowrie GitHub organization.
Targeted Technical Use Cases
Capturing brute-force campaigns and post-login tradecraft on exposed SSH and Telnet services.
Evaluation & Trade-offs
Core Strengths
- +Session capture is detailed enough for tradecraft analysis.
- +Configurable interaction depth from log-only to full shell.
- +Long history with wide community use.
Trade-Offs & Limitations
- -Emulation gaps can tip off skilled attackers.
- -High-interaction mode requires careful isolation.
Defensive Security Application
Learning current brute-force and post-exploitation behavior against remote access services.
Frequently Asked Questions
What is Cowrie?→
Cowrie imitates an SSH and Telnet server, accepting connections, logging credentials used by brute-force attempts, and optionally letting attackers into a emulated shell where commands, files, and downloads are recorded. Its logs feed research, threat intelligence, and detection work, and it is one of the most widely deployed SSH honeypots. An active community maintains the project under the Cowrie GitHub organization.
What is Cowrie used for?→
Capturing brute-force campaigns and post-login tradecraft on exposed SSH and Telnet services.
What are the strengths of Cowrie?→
- +Session capture is detailed enough for tradecraft analysis.
- +Configurable interaction depth from log-only to full shell.
- +Long history with wide community use.
What are the limitations of Cowrie?→
- +Emulation gaps can tip off skilled attackers.
- +High-interaction mode requires careful isolation.
How is Cowrie used defensively?→
Learning current brute-force and post-exploitation behavior against remote access services.