Cowrie
Medium to high interaction SSH and Telnet honeypot that records attacker sessions.
Technical Architecture & Overview
Cowrie imitates an SSH and Telnet server, accepting connections, logging credentials used by brute-force attempts, and optionally letting attackers into an emulated shell where commands, files, and downloads are recorded. A high interaction proxy mode forwards sessions to real or QEMU-emulated systems, and an experimental LLM backend generates shell responses. Its logs feed research, threat intelligence, and detection work, and Michel Oosterhof maintains the project under the Cowrie GitHub organization.
Targeted Technical Use Cases
Capturing brute-force campaigns and post-login tradecraft on exposed SSH and Telnet services.
Evaluation & Trade-offs
Core Strengths
- +Session capture is detailed enough for tradecraft analysis.
- +Configurable interaction depth from log-only to full shell.
- +Long history: based on the Kippo honeypot, with many community contributors.
Trade-Offs & Limitations
- -Emulation gaps can tip off skilled attackers.
- -High-interaction mode requires careful isolation.
Defensive Security Application
Learning current brute-force and post-exploitation behavior against remote access services.
Frequently Asked Questions
What is Cowrie?→
Cowrie imitates an SSH and Telnet server, accepting connections, logging credentials used by brute-force attempts, and optionally letting attackers into an emulated shell where commands, files, and downloads are recorded. A high interaction proxy mode forwards sessions to real or QEMU-emulated systems, and an experimental LLM backend generates shell responses. Its logs feed research, threat intelligence, and detection work, and Michel Oosterhof maintains the project under the Cowrie GitHub organization.
What is Cowrie used for?→
Capturing brute-force campaigns and post-login tradecraft on exposed SSH and Telnet services.
What are the strengths of Cowrie?→
- +Session capture is detailed enough for tradecraft analysis.
- +Configurable interaction depth from log-only to full shell.
- +Long history: based on the Kippo honeypot, with many community contributors.
What are the limitations of Cowrie?→
- +Emulation gaps can tip off skilled attackers.
- +High-interaction mode requires careful isolation.
How is Cowrie used defensively?→
Learning current brute-force and post-exploitation behavior against remote access services.